CVE-2009-0654: Tor 0.2.0.28, and probably 0.2.0.34 and earlier, allows remote attackers, with control of an entry router a...

Security readout for executives and security teams

This issue concerns older Tor versions where an attacker controlling both the entry and exit router could confirm that two parties were communicating. The harm is loss of anonymity, not system takeover. The vendor disputed the practical significance, noting that Tor already treats end-to-end correlation as an accepted design risk. Exposure is likely limited to environments using the named older Tor versions or relying on them for anonymity-sensitive workflows. The source bundle does not identify affected CPEs, supported platforms, or a vendor patch state. Treat this as a targeted anonymity risk, not a broad infrastructure compromise. Prioritize if the organization used the affected Tor versions for sensitive communications, investigations, whistleblower channels, or other workflows where confirming relationships creates business or safety impact. Mitigation focus: Inventory any use of Tor 0.2.0.28, 0.2.0.34, or earlier.; Review Tor Project guidance before deciding technical remediation.; Avoid relying on affected versions for high-sensitivity anonymity workflows..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.