How severe is CVE-2007-1103?

CVE-2007-1103 has a CVSS 2.0 base score of 4.3, rated medium severity.

Is CVE-2007-1103 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (74th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2007-1103?

CVE-2007-1103 affects Tor. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2007-1103?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2007-1103 published?

CVE-2007-1103 was published on 2007-02-26 and last updated on 2026-06-16.

CVE-2007-1103

CVE-2007-1103 is a medium-severity vulnerability in Tor with a CVSS 2.0 base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 2.0 base score 4.3)
EPSS exploit prediction: 2% (74th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Tor
Published: 2007-02-26
Last modified: 2026-06-16

Description

Tor does not verify a node's uptime and bandwidth advertisements, which allows remote attackers who operate a low resource node to make false claims of greater resources, which places the node into use for many circuits and compromises the anonymity of traffic sources and destinations.

Frequently asked questions

What is CVE-2007-1103?: Tor does not verify a node's uptime and bandwidth advertisements, which allows remote attackers who operate a low resource node to make false claims of greater resources, which places the node into use for many circuits and compromises the anonymity of traffic sources and destinations.
How severe is CVE-2007-1103?: CVE-2007-1103 has a CVSS 2.0 base score of 4.3, rated medium severity.
Is CVE-2007-1103 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (74th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2007-1103?: CVE-2007-1103 affects Tor. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2007-1103?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2007-1103 published?: CVE-2007-1103 was published on 2007-02-26 and last updated on 2026-06-16.

References

Affected products (1)

cpe:2.3:a:tor:tor:*:*:*:*:*:*:*:*

More vulnerabilities in Tor

CVE-2010-1676 — Critical (CVSS 10.0): Heap-based buffer overflow in Tor before 0.2.1.28 and 0.2.2.x before 0.2.2.20-alpha allows remote attackers to cause a…
CVE-2009-0939 — Critical (CVSS 10.0): Tor before 0.2.0.34 treats incomplete IPv4 addresses as valid, which has unknown impact and attack vectors related to…
CVE-2009-0414 — Critical (CVSS 10.0): Unspecified vulnerability in Tor before 0.2.0.33 has unspecified impact and remote attack vectors that trigger heap…
CVE-2008-5398 — Critical (CVSS 9.3): Tor before 0.2.0.32 does not properly process the ClientDNSRejectInternalAddresses configuration option in situations…
CVE-2011-2778 — High (CVSS 7.6): Multiple heap-based buffer overflows in Tor before 0.2.2.35 allow remote attackers to cause a denial of service (memory…
CVE-2006-3409 — High (CVSS 7.5): Integer overflow in Tor before 0.1.1.20 allows remote attackers to execute arbitrary code via crafted large inputs,…

All CVEs affecting Tor →