How severe is CVE-2024-39920?

CVE-2024-39920 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2024-39920 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2024-39920?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-39920 have an EU (EUVD) identifier?

Yes. CVE-2024-39920 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-38300.

When was CVE-2024-39920 published?

CVE-2024-39920 was published on 2024-07-03 and last updated on 2026-06-17.

CVE-2024-39920

CVE-2024-39920 is a medium-severity vulnerability with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1255.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
EPSS exploit prediction: 1% (43rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-38300
Weakness: CWE-1255
Published: 2024-07-03
Last modified: 2026-06-17

Description

The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system (to any server), when that client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server, aka the "SnailLoad" issue. For example, the attack can begin by measuring RTTs via the TCP segments whose role is to provide an ACK control bit and an Acknowledgment Number.

Frequently asked questions

What is CVE-2024-39920?: The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection from a client system (to any server), when that client system is concurrently obtaining TCP data at a slow rate from an attacker-controlled server, aka the "SnailLoad" issue. For example, the attack can begin by measuring RTTs via the TCP segments whose role is to provide an ACK control bit and an Acknowledgment Number.
How severe is CVE-2024-39920?: CVE-2024-39920 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2024-39920 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2024-39920?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-39920 have an EU (EUVD) identifier?: Yes. CVE-2024-39920 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-38300.
When was CVE-2024-39920 published?: CVE-2024-39920 was published on 2024-07-03 and last updated on 2026-06-17.

References

Other CWE-1255 vulnerabilities

CVE-2025-3301 — Low (CVSS 1.0): DPA countermeasures are unavailable for ECDH key agreement and EdDSA signing operations on Curve25519 and Curve448 on…

Browse all CWE-1255 vulnerabilities →