PT-2025-38402 · Tor+1 · Tor+1

Wocanmei · Published 2025-09-18 · Updated 2025-09-25 · CVE-2025-4444

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Tor versions 0.4.7.16 through 0.4.8.17

Description A security flaw exists in Tor within the Onion Service Descriptor Handler component. Manipulation of this component can lead to resource consumption. The issue is potentially exploitable remotely and is considered difficult to exploit.

Recommendations Upgrade to version 0.4.8.18. Upgrade to version 0.4.9.3-alpha.

Fix

Resource Exhaustion

Improper Resource Release

Weakness Enumeration

CWE-400

CWE-404

Related Identifiers

CVE-2025-4444

OPENSUSE-SU-2025:15571-1

Affected Products

Debian

Tor

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2025-4444 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15571-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-4444 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-4444 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-4444 · Security Note
• https://forum.torproject.org/t/alpha-and-stable-release-0-4-8-18-and-0-4-9-3-alpha/20578 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-4444 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-4444 · Vendor Advisory
• https://vuldb.com/?ctiid.324814 · Note
• https://vuldb.com/?submit.640605 · Note
• https://twitter.com/CVEnew/status/1968718097445204125 · Twitter Post
• https://github.com/chunmianwang/Tordos · Note
• https://vuldb.com/?id.324814 · Note
• https://twitter.com/zeeshankghouri/status/1971055293338734816 · Twitter Post
• https://suse.com/security/cve/CVE-2025-4444 · Note