Lucky Thirteen
A 2013 timing attack that exploits how TLS computes the MAC over CBC-padded records, so that small timing differences leak data.
Nadhem AlFardan and Kenneth Paterson showed in 2013 that TLS with CBC ciphers in the MAC-then-encrypt order leaked information through timing. The receiver computes HMAC over a number of blocks that depends on the padding length, and the difference shows up in response time. With millions of connections, an attacker could recover small parts of the plaintext, such as a cookie, even though the cryptography itself was sound.
It is one of many cases where the algorithm holds and the implementation leaks. The remedies were to run the HMAC over the same number of blocks regardless of padding and, above all, to move to AEAD. TLS 1.3 dropped CBC ciphers altogether, so the problem is mostly a legacy of older versions.