What’s Vulnerable › Vulnerabilities

CVE-2021-39246

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-09-24 · updated 2026-06-17
• Weakness: CWE-532

Description

Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion addresses. Exact timestamps of these onion-service visits are logged locally, and an attacker might be able to compare them to timestamp data collected by the destination server (or collected by a rogue site within the Tor network).

Affected products

• torproject Tor Browser: through 10.5.6; 11.0-alpha2, 11.0-alpha4

References

• https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-111.md
• https://gitlab.torproject.org/tpo/core/tor/-/commit/80c404c4b79f3bcba3fc4585d4c62a62a04f3ed9
• https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/434
• https://sick.codes/sick-2021-111
• https://www.privacyaffairs.com/cve-2021-39246-tor-vulnerability
• https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-111.md
• https://gitlab.torproject.org/tpo/core/tor/-/commit/80c404c4b79f3bcba3fc4585d4c62a62a04f3ed9
• https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/434
• https://sick.codes/sick-2021-111
• https://www.privacyaffairs.com/cve-2021-39246-tor-vulnerability

Get alerted when CVE-2021-39246 or the next vulnerability affects your stack