CVE-2021-28089

HIGH 7.5CVE-2021-28089 · Published 19/03/2021 · updated 17/06/2026

In short

CVE-2021-28089 is a HIGH (CVSS 7.5) vulnerability affecting tor (torproject).
Chance of exploitation in the next 30 days (EPSS): 1.7%, higher than 76.8% of all vulnerabilities.
Fix: update to 0.4.4.8, 0.4.5.7, 0.3.5.14 or later.

Package	Affected versions	Patched versions
tor torproject	`= 0.4.4.0= 0.4.4.1= 0.4.4.2= 0.4.4.3≥ 0.4.4.4, < 0.4.4.8≥ 0.4.5.0, < 0.4.5.7< 0.3.5.14`	`0.4.4.80.4.5.70.3.5.14`

Tor before 0.4.5.7 allows a remote participant in the Tor directory protocol to exhaust CPU resources on a target, aka TROVE-2021-001.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

= 0.4.4.0= 0.4.4.1= 0.4.4.2= 0.4.4.3≥ 0.4.4.4, < 0.4.4.8≥ 0.4.5.0, < 0.4.5.7< 0.3.5.14

0.4.4.80.4.5.70.3.5.14

More vulnerabilities in tor

See all →