CVE-2012-3518: The networkstatus_parse_vote_from_string function in routerparse.c in Tor before 0.2.2.38 does not properly...

Security readout for executives and security teams

This is an old Tor availability flaw fixed in 0.2.2.38. A remote malformed directory vote or consensus document could make a vulnerable Tor daemon read out of bounds and crash. The provided sources support service interruption risk, not data theft or code execution. Exposure is likely limited to systems running Tor versions before 0.2.2.38, especially relays or services that process Tor directory vote or consensus documents. Modern maintained Tor deployments should already be beyond this release. Treat as a hygiene and availability issue. It is old and patched, but any remaining vulnerable Tor daemon can be remotely crashed, disrupting privacy, routing, or dependency services that rely on it. Mitigation focus: Upgrade Tor to 0.2.2.38 or later per Tor vendor guidance.; Apply relevant distribution security updates from Gentoo, openSUSE, or your OS vendor.; Prioritize unsupported or internet-facing Tor daemon hosts first..

Prepared

Jun 28, 2026, 00:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.