Collected research

Scalable Scanning and Automatic Classification of TLS Padding Oracle Vulnerabilities

Robert Merget, Juraj Somorovsky, Nimrod Aviram, Craig Young, Janis Fliegenschmidt, Jörg Schwenk and Yuval Shavitt · usenix.org

First large-scale scan for CBC padding oracle flaws in TLS, using a reduced probe set and automatic classification of server response fingerprints. It found 1.83 percent of the Alexa Top Million vulnerable across nearly 100 distinct behaviours, many exploitable simply by observing differing responses rather than by precise timing measurement.

Record

Researcher

Robert Merget, Juraj Somorovsky, Nimrod Aviram, Craig Young, Janis Fliegenschmidt, Jörg Schwenk and Yuval Shavitt

Published by

usenix.org

Topic

Crypto

In the archive

• Collected in the 2019 research round

Related sources

• USENIX Security '19 - Scalable Scanning and Automatic Classification of TLS Padding Oracle

Tags

• side-channel
• tls
• https
• timing-attack
• large-scale-scan
• measurement-study
• detection
• info-leak
• owasp-a02-2021
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of Robert Merget, Juraj Somorovsky, Nimrod Aviram, Craig Young, Janis Fliegenschmidt, Jörg Schwenk and Yuval Shavitt, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.