CVE-2015-2689

HIGH

Tor < 0.2.4.26 and 0.2.5.x < 0.2.5.11 - Denial of Service via DNS Load Handling

Title source: llm
STIX 2.1

Description

Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.

References (2)

Core 2
Core References
Mailing List, Vendor Advisory x_refsource_misc
https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html
Patch, Vendor Advisory x_refsource_misc
https://trac.torproject.org/projects/tor/ticket/14129

Scores

CVSS v3 7.5
EPSS 0.0219
EPSS Percentile 80.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-20
Status published
Products (1)
torproject/tor < 0.2.4.26
Published Jan 24, 2020
Tracked Since Feb 18, 2026