PKCS #1 v1.5 padding
The older RSA padding scheme that handed Bleichenbacher an oracle, and which still survives in systems where nobody has dared to switch it off.
PKCS #1 v1.5 pads the message with a zero byte, a fixed type byte and random non-zero bytes before the RSA operation. The receiver checks the padding, and if it is wrong, the error itself can be enough. In 1998, Daniel Bleichenbacher showed that such a yes-or-no answer lets an attacker decrypt an RSA ciphertext in roughly a million requests, by manipulating the ciphertext until the padding happens to be valid.
PKCS #1 v2.0, also from 1998, replaced it with OAEP. v1.5 is still around in older TLS configurations and legacy systems. The real fix is to move to OAEP. Hiding the error code only treats the symptom, and variants of the Bleichenbacher attack have kept turning up in new forms ever since.