CVE-2021-39246

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion addresses. Exact timestamps of these onion-service visits are logged locally, and an attacker might be able to compare them to timestamp data collected by the destination server (or collected by a rogue site within the Tor network).

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-111.mdExploit, Third Party Advisory
https://gitlab.torproject.org/tpo/core/tor/-/commit/80c404c4b79f3bcba3fc4585d4c62a62a04f3ed9Patch, Vendor Advisory
https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/434Vendor Advisory
https://sick.codes/sick-2021-111Exploit, Third Party Advisory
https://www.privacyaffairs.com/cve-2021-39246-tor-vulnerabilityThird Party Advisory
https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-111.mdExploit, Third Party Advisory
https://gitlab.torproject.org/tpo/core/tor/-/commit/80c404c4b79f3bcba3fc4585d4c62a62a04f3ed9Patch, Vendor Advisory
https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/434Vendor Advisory
https://sick.codes/sick-2021-111Exploit, Third Party Advisory
https://www.privacyaffairs.com/cve-2021-39246-tor-vulnerabilityThird Party Advisory

Timeline

Published: Sep 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-392476.5Zint Barcode Generator before 2.10.0 has a one-byte buffer over-read, related to is_last_single_ascii in code1.c, and rs_encode_uint in reed CVE-2021-392486.1Open edX through Lilac.1 allows XSS in common/static/common/js/discussion/utils.js via crafted LaTeX content within a discussion.CVE-2021-392496.1Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become CVE-2021-392505.4Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploade CVE-2021-392517.8A crafted NTFS image can cause a NULL pointer dereference in ntfs_extent_inode_open in NTFS-3G < 2021.8.22.CVE-2021-392527.8A crafted NTFS image can cause an out-of-bounds read in ntfs_ie_lookup in NTFS-3G < 2021.8.22.CVE-2021-392537.8A crafted NTFS image can cause an out-of-bounds read in ntfs_runlists_merge_i in NTFS-3G < 2021.8.22.CVE-2021-392547.8A crafted NTFS image can cause an integer overflow in memmove, leading to a heap-based buffer overflow in the function ntfs_attr_record_resi CVE-2021-392557.8A crafted NTFS image can trigger an out-of-bounds read, caused by an invalid attribute in ntfs_attr_find_in_attrdef, in NTFS-3G < 2021.8.22.CVE-2021-392567.8A crafted NTFS image can cause a heap-based buffer overflow in ntfs_inode_lookup_by_name in NTFS-3G < 2021.8.22.CVE-2021-392575.5A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs_attr_pwrite), causin CVE-2021-392587.8A crafted NTFS image can cause out-of-bounds reads in ntfs_attr_find and ntfs_external_attr_find in NTFS-3G < 2021.8.22.