← Vulnerability feed

Vulnerability record · CVE-2008-1948 · published 21 May 2008

CVE-2008-1948: Gnutls vulnerability

Gnu · Gnutls

The _gnutls_server_name_recv_params function in lib/ext_server_name.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a zero value for the length of Server Names, which leads to a buffer overflow in session resumption data in the pack_security_parameters function, aka GNUTLS-SA-2008-1-1.

10.0 CVSS 2.0 High EPSS 12% · top 4.0% CWE-189 · CWE-189
10.0CVSS 2.0 base score
12%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
80References, 4 tagged exploit
16 Jun 2026Last modified by NVD

Description

The _gnutls_server_name_recv_params function in lib/ext_server_name.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a zero value for the length of Server Names, which leads to a buffer overflow in session resumption data in the pack_security_parameters function, aka GNUTLS-SA-2008-1-1.

AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commitdiff%3Bh=bc8102405fda11ea00ca3b42acc4f4bce9d6e97b
http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00051.html
http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00055.html Exploit
http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00060.html
http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00003.html
http://secunia.com/advisories/30287
http://secunia.com/advisories/30302
http://secunia.com/advisories/30317
http://secunia.com/advisories/30324
http://secunia.com/advisories/30330
http://secunia.com/advisories/30331
http://secunia.com/advisories/30338
http://secunia.com/advisories/30355
http://secunia.com/advisories/31939
http://security.gentoo.org/glsa/glsa-200805-20.xml
http://securityreason.com/securityalert/3902
http://sourceforge.net/project/shownotes.php?release_id=600646&group_id=21558
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0174
http://www.cert.fi/haavoittuvuudet/advisory-gnutls.html Exploit
http://www.debian.org/security/2008/dsa-1581
http://www.kb.cert.org/vuls/id/111034 US Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2008:106
http://www.openwall.com/lists/oss-security/2008/05/20/1
http://www.openwall.com/lists/oss-security/2008/05/20/2 Patch
http://www.openwall.com/lists/oss-security/2008/05/20/3
http://www.redhat.com/support/errata/RHSA-2008-0489.html
http://www.redhat.com/support/errata/RHSA-2008-0492.html
http://www.securityfocus.com/archive/1/492282/100/0/threaded
http://www.securityfocus.com/archive/1/492464/100/0/threaded
http://www.securityfocus.com/bid/29292 Patch
http://www.securitytracker.com/id?1020057
http://www.ubuntu.com/usn/usn-613-1
http://www.vupen.com/english/advisories/2008/1582/references
http://www.vupen.com/english/advisories/2008/1583/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/42532
https://issues.rpath.com/browse/RPL-2552
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10935
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00487.html
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00590.html
https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00615.html

Track CVE-2008-1948 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-42010Gnutls vulnerabilityA flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL ch…EPSS 0.94%9.8CVE-2021-20231Gnutls use after free vulnerabilityA flaw was found in gnutls. A use after free issue in client sending key_share extension may lead to memory corruption and other consequences.EPSS 3.8%9.8CVE-2021-20232Gnutls use after free vulnerabilityA flaw was found in gnutls. A use after free issue in client_send_params in lib/ext/pre_shared_key.c may lead to memory corruption and other potentia…EPSS 3.4%9.8CVE-2017-5334Opensuse leap double free vulnerabilityDouble free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have…EPSS 33%9.8CVE-2017-5336Opensuse leap memory buffer overflow vulnerabilityStack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote att…EPSS 7.1%9.8CVE-2017-5337Opensuse leap memory buffer overflow vulnerabilityMultiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have uns…EPSS 6.2%9.8CVE-2009-3555TLS/SSL renegotiation flaw allows plaintext injection into sessionsThe TLS protocol and SSL 3.0 do not properly bind renegotiation handshakes to the existing connection, so a man-in-the-middle can inject data that th…EPSS 87%analysed9.3CVE-2008-1949Gnutls improper authentication vulnerabilityThe _gnutls_recv_client_kx_message function in lib/gnutls_kx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello m…EPSS 5.8%

Source: NIST National Vulnerability Database (record CVE-2008-1948), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.