CVE-2024-39920

CVE-2024-39920 describes a timing side channel vulnerability in the TCP protocol (RFC 9293), dubbed "SnailLoad," that allows remote attackers to infer the content of a client's TCP connections. This attack is possible when the client is simultaneously receiving slow data from an attacker-controlled server. Rated Medium severity with a CVSS score of 4.3, the vulnerability has an adjacent attack vector and low attack complexity, potentially leading to a loss of confidentiality. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.