CVE-2024-39920
Last modified
CVE-2024-39920 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system (to any server), when that client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server, aka the "SnailLoad" issue. For example, the attack can begin by measuring RTTs via the TCP segments whose role is to provide an ACK control bit and an Acknowledgment Number.. EPSS estimates a 0.57% chance of exploitation in the next 30 days.
Description
The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system (to any server), when that client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server, aka the "SnailLoad" issue. For example, the attack can begin by measuring RTTs via the TCP segments whose role is to provide an ACK control bit and an Acknowledgment Number.
Metrics
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-39920?
How severe is CVE-2024-39920?
How do I fix CVE-2024-39920?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-39915Thruk is a multibackend monitoring webinterface for Naemon, …9.9
- CVE-2024-39916FOG is a free open-source cloning/imaging/rescue suite/inven…6.4
- CVE-2024-39917xrdp is an open source RDP server. xrdp versions prior to 0.…9.8
- CVE-2024-39918@jmondi/url-to-png is an open source URL to PNG utility feat…4.3
- CVE-2024-39919@jmondi/url-to-png is an open source URL to PNG utility feat…3.1
- CVE-2024-3992The Amen WordPress plugin through 3.3.1 does not sanitise an…4.8
- CVE-2024-39921Observable timing discrepancy issue exists in IPCOM EX2 Seri…7.5
- CVE-2024-39922A vulnerability has been identified in LOGO! 12/24RCE (6ED10…5.1
- CVE-2024-39923An issue was discovered in Mahara 24.04 before 24.04.2 and 2…6.1
- CVE-2024-39924An issue was discovered in Vaultwarden (formerly Bitwarden_R…8.8
- CVE-2024-39925An issue was discovered in Vaultwarden (formerly Bitwarden_R…6.5
- CVE-2024-39926An issue was discovered in Vaultwarden (formerly Bitwarden_R…5.4
Are you affected by CVE-2024-39920?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST