CVE-2021-28089: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001.

Affected products

• Fedoraproject Fedora: version 33 only
• Torproject Tor: before 0.3.5.14 (fixed in 0.3.5.14); from 0.4.4.4, before 0.4.4.8 (fixed in 0.4.4.8); from 0.4.5.0, before 0.4.5.7 (fixed in 0.4.5.7); version 0.4.4.0 only; version 0.4.4.1 only; version 0.4.4.2 only; …

Published 2021-03-19. Last modified 2026-06-17.