CVE-2008-1950

CVE-2008-1950 describes an integer signedness error in the _gnutls_ciphertext2compressed function within the libgnutls library, affecting GnuTLS versions prior to 2.2.4. This flaw allows remote attackers to trigger a denial of service (buffer over-read and crash) by sending a crafted Client Hello message with an invalid Record Length, leading to an incorrect cipher padding length. The vulnerability has a CVSS score of 5.0, indicating a medium severity with a network-based attack vector, low attack complexity, and potential for partial availability impact. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are minimal, with only one mention and one article identified, neither of which suggests widespread attention or exploitation.