CVE-2008-1949: GNU Gnutls

High severity, CVSS 9.3. EPSS: 5.8% chance of exploitation in the next 30 days.

The _gnutls_recv_client_kx_message function in lib/gnutls_kx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service (NULL dereference and crash) via a TLS message containing multiple Client Hello messages, aka GNUTLS-SA-2008-1-2.

Affected products

• GNU Gnutls: version 1.0.18 only; version 1.0.19 only; version 1.0.20 only; version 1.0.21 only; version 1.0.22 only; version 1.0.23 only; …

Published 2008-05-21. Last modified 2026-06-16.