CVE-2024-3296: rust-openssl Observable Timing Discrepancy
Vulnerability summary
CVE-2024-3296 is a medium (CVSS 5.9) Observable Timing Discrepancy vulnerability in rust-openssl. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.3% of scored vulnerabilities.
Timeline
- 04-04-2024PublishedVulnerability first disclosed.
- 25-02-2026Last modifiedVulnerability information updated.
Description
A timing-based side-channel flaw exists in the rust-openssl package, which could be sufficient to recover a plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages for decryption. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
0.00 pp
From 0.41% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- rust-opensslAll versions (No fix recorded)
Ubuntu1 product
- rust-opensslAll versions (No fix recorded)
2 vendors · 2 products
