CVE-2020-10593: Opensuse Backports Sle

High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days.

Tor before 0.3.5.10, 0.4.x before 0.4.1.9, and 0.4.2.x before 0.4.2.7 allows remote attackers to cause a Denial of Service (memory leak), aka TROVE-2020-004. This occurs in circpad_setup_machine_on_circ because a circuit-padding machine can be negotiated twice on the same circuit.

Affected products

• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.1 only
• Torproject Tor: from 0.3.5, before 0.3.5.10 (fixed in 0.3.5.10); after 0.4.1.0, before 0.4.1.9 (fixed in 0.4.1.9); after 0.4.2.0, up to and including 0.4.2.7

Published 2020-03-23. Last modified 2026-06-17.