CVE-2008-1948

CVE-2008-1948 describes a critical buffer overflow vulnerability in GnuTLS versions prior to 2.2.4, specifically within the _gnutls_server_name_recv_params function. This flaw allows remote attackers to trigger a denial of service (crash) or potentially execute arbitrary code by sending a crafted TLS 1.0 Client Hello message with a zero-length Server Names field. With a CVSS score of 10.0, this vulnerability is extremely severe, indicating a network-exploitable attack with low complexity, requiring no authentication, and leading to complete compromise of confidentiality, integrity, and availability. While the EPSS score is relatively low, its FAUCET Risk Score of 94/100 highlights its significant danger. There is no evidence of active exploitation, nor are there public exploits available in Metasploit, Nuclei, or ExploitDB, and community discussion and media coverage are minimal, suggesting it has not garnered widespread attention.