CVE-2008-2377

CVE-2008-2377 is a use-after-free vulnerability in the GnuTLS library, specifically within the _gnutls_handshake_hash_buffers_clear function, affecting versions 2.3.5 through 2.4.0. This flaw allows remote attackers to trigger a denial of service (crash) or potentially execute arbitrary code by manipulating TLS data during a normal session, leading to access of a deallocated libgcrypt handle. The vulnerability has a CVSS score of 7.6, indicating high severity due to its network-based attack vector, high attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. Despite its age, there is no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and it is not listed in CISA's KEV catalog. Community discussion and media coverage are minimal, with only one mention and one article, respectively, suggesting low current attention.