Read the docs
TI-2020-12249 Aliases CVE-2020-15572GHSA-cfp9-244f-h66c

Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote…

Priority LOW 36CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

Tor before 0.4.3.6 has an out-of-bounds memory access that allows a remote denial-of-service (crash) attack against Tor instances built to use Mozilla Network Security Services (NSS), aka TROVE-2020-001.

Why it matters now

EPSS 0.01404 72nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*before 0.3.5.11; after 0.4.2.0, before 0.4.2.8; after 0.4.3.0, before 0.4.3.6Vulnerabletorproject
cpe:2.3:a:torproject:tor:0.4.4.0:alpha:*:*:*:*:*:*0.4.4.0 alphaVulnerabletorproject
cpe:2.3:a:torproject:tor:0.4.4.1:alpha:*:*:*:*:*:*0.4.4.1 alphaVulnerabletorproject
  • cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:* Versions before 0.3.5.11; after 0.4.2.0, before 0.4.2.8; after 0.4.3.0, before 0.4.3.6 Vulnerable ·torproject
  • cpe:2.3:a:torproject:tor:0.4.4.0:alpha:*:*:*:*:*:* Versions 0.4.4.0 alpha Vulnerable ·torproject
  • cpe:2.3:a:torproject:tor:0.4.4.1:alpha:*:*:*:*:*:* Versions 0.4.4.1 alpha Vulnerable ·torproject

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15572
  2. 2026-10-03 Alias added: GHSA-cfp9-244f-h66c

References

Advisory 3

  • TI-2016-07433 Use after free in Mozilla Firefox KEVCVSS 3.1HIGH 7.5
  • TI-2023-09419 The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4… CVSS 3.1MEDIUM 6.5
  • TI-2018-00448 Use after free in Tor CVSS 3.0HIGH 7.5
  • TI-2026-54108 Race condition in torproject Tor CVSS 3.1CRITICAL 9.0
  • TI-2026-54112 Out-of-bounds write in torproject Tor CVSS 3.1CRITICAL 9.3
  • TI-2026-32508 Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell… CVSS 3.1CRITICAL 9.1
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences