What is CVE-2024-39920?

CVE-2024-39920 is a medium-severity vulnerability in N/a, classified under CWE-1255. CVSS score: 4.3/10. Published 2024-07-03.

How severe is CVE-2024-39920?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2024-39920 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in N/a

CVE-2024-39920

The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system (to any server), when that client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server, aka the "SnailLoad" issue. For example, the attack can begin by measuring RTTs via the TCP segments whose role is to provide an ACK control bit and an Acknowledgment Number.

EPSS: 0.006 (43.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

N/a — versions n/a

Weakness classification (CWE)

CWE-1255

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

Frequently asked questions

What is CVE-2024-39920?: CVE-2024-39920 is a medium-severity vulnerability in N/a, classified under CWE-1255. CVSS score: 4.3/10. Published 2024-07-03.
How severe is CVE-2024-39920?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2024-39920 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.