CVE-2007-3165: Tor before 0.1.2.14 can construct circuits in which an entry guard is in the same family as the exit node,...

Security readout for executives and security teams

Older Tor versions could build a path where the first and last relay were related. That weakens Tor’s anonymity goal because a related observer may see both ends of a user’s traffic path. The issue is important for users who depended on Tor for sensitive privacy, but the source bundle does not show active exploitation. Exposure is limited to deployments running Tor before 0.1.2.14. The bundle does not identify specific operating systems, packages, appliances, or CPEs. Modern supported Tor installations are unlikely to be affected, but legacy systems, old images, or archived tooling should be checked. Treat this as targeted legacy-risk cleanup. It is not presented as actively exploited, but it matters where the business relies on Tor for anonymity, investigative work, journalism support, or sensitive research operations. Mitigation focus: Upgrade Tor to 0.1.2.14 or later where affected versions exist.; Check current Tor vendor guidance and package maintainer advisories.; Remove obsolete Tor binaries from hosts, containers, and archived tooling..

Prepared

Jun 29, 2026, 05:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.