ROBOT (Return Of Bleichenbacher's Oracle Threat), disclosed in 2017, was a rediscovery of a padding oracle vulnerability in RSA key exchange first described by researcher Daniel Bleichenbacher back in 1998 — nearly two decades earlier — showing that some implementations still hadn't fully closed a well-documented weakness.
Why it kept resurfacing
The underlying vulnerability is subtle to fix completely — several major vendors' implementations, across nearly two decades, were found to still be vulnerable to variants of the same core issue when ROBOT's researchers tested a wide swath of the internet's servers.
The broader takeaway
ROBOT is a specific, concrete argument for forward-secret key exchange (ECDHE/DHE) over RSA key exchange — forward-secret methods aren't vulnerable to this particular class of attack, which is part of why TLS 1.3 dropped non-forward-secret RSA key exchange from the protocol entirely.
Why Bleichenbacher's original 1998 finding took so long to fully eliminate
Daniel Bleichenbacher's original 1998 research described a padding oracle attack against RSA PKCS#1 v1.5 padding used in SSL's key exchange, and while the specific attack he described was patched at the time, the underlying padding scheme itself remained in widespread use for years afterward, since fully removing it would have required a broader protocol or implementation change rather than a narrow patch. Different implementations, patched independently and imperfectly over nearly two decades, kept reintroducing subtly different variants of the same fundamental class of vulnerability.
What made the 2017 rediscovery notable beyond the vulnerability itself
The ROBOT researchers' internet-wide scan found that several major vendors' TLS implementations, including some very widely deployed commercial products, were still vulnerable to variants of Bleichenbacher's attack nearly twenty years after it was first published, underscoring how a well-known, well-documented vulnerability class can still persist at scale if it isn't systematically eliminated at the protocol level rather than patched piecemeal across many separate implementations.
Who rediscovered the vulnerability and coined its name
ROBOT was disclosed by researchers Hanno Böck, Juraj Somorovsky, and Craig Young, who deliberately chose the backronym Return Of Bleichenbacher's Oracle Threat specifically to credit Bleichenbacher's original 1998 research while emphasizing that this was fundamentally the same vulnerability class resurfacing, not a genuinely new discovery.
Which major vendors were found affected in the original disclosure
The original ROBOT research identified vulnerable implementations across several major vendors' products, including at the time some widely-deployed commercial load balancer and server software — the breadth of affected major vendors was part of what made the disclosure particularly notable, since it demonstrated the issue wasn't confined to obscure or poorly-maintained software alone.
How TLS 1.3 makes this entire vulnerability class structurally impossible
Because TLS 1.3 removed RSA key exchange from the protocol entirely, requiring forward-secret ECDHE key exchange for every session, ROBOT and every earlier variant of the Bleichenbacher padding oracle attack simply cannot apply to a TLS 1.3 connection — a clean, structural elimination rather than an ongoing patching effort against a persistent vulnerability class.
Why ROBOT is sometimes cited as evidence for periodic re-auditing of old, patched vulnerabilities
ROBOT's core lesson, that a well-documented, supposedly patched vulnerability from nearly two decades earlier could still be found affecting major vendors when someone specifically went looking again, has become a standing argument for periodic re-auditing of historical vulnerability classes across an organization's infrastructure, rather than assuming a vulnerability patched once, long ago, can be considered permanently closed without ever being re-verified.
What its rediscovery says about vulnerability research incentives
ROBOT's researchers deliberately chose to re-examine a well-known, decades-old vulnerability class rather than pursue an entirely novel one — a research strategy that paid off significantly, and one that's since encouraged other researchers to periodically revisit historically significant vulnerability classes against current software, rather than assuming older, well-documented issues are necessarily fully resolved everywhere.
ROBOT's twenty-year gap between original discovery and full industry remediation is a sobering data point for anyone assuming an old, well-known vulnerability is necessarily long closed.