CVE-2009-2730

CVE-2009-2730 describes a critical vulnerability in GnuTLS versions prior to 2.8.2, where the libgnutls library fails to correctly process null characters in X.509 certificate domain names (Common Name or Subject Alternative Name fields). This flaw enables man-in-the-middle attackers to spoof legitimate SSL servers using specially crafted certificates issued by trusted Certification Authorities. With a CVSS score of 7.5, this vulnerability is considered highly severe due to its network-based attack vector, low attack complexity, and potential for partial compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation, no public exploit code (Metasploit, Nuclei, ExploitDB), and limited community discussion, the vulnerability's nature makes it a significant risk if exploited.