CVE-2012-3519: routerlist.c in Tor before 0.2.2.38 uses a different amount of time for relay-list iteration depending on w...

Security readout for executives and security teams

This is an old Tor privacy weakness fixed in Tor 0.2.2.38. A timing difference in relay-list handling could let a remote observer infer sensitive information about relay selection. The sources do not show active exploitation or CISA KEV listing. Exposure is mainly legacy systems running Tor versions before 0.2.2.38, including old source builds, appliances, or distribution packages. Modern supported Tor installations are unlikely to be affected if fully updated. Low for most organizations because this is a 2012 issue with a long-available fix and no cited active exploitation. Treat as moderate priority where Tor supports sensitive anonymity, research, or investigative workflows. Mitigation focus: Upgrade Tor to 0.2.2.38 or later where any older Tor build exists.; Apply relevant operating-system vendor updates for Tor packages.; Inventory embedded, appliance, and source-built Tor deployments..

Prepared

Jun 28, 2026, 00:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.