An API design flaw in WebKitGTK and WPE WebKit, identified as CWE‑639, allows untrusted web content to make arbitrary IP connections, DNS lookups, and HTTP requests without passing through the WebPage::send‑request signal. The flaw permits the content to bypass the application's explicit approval mechanism, enabling an attacker to trigger network activity that the application was intended to control. This reduces the integrity of the network access control and can facilitate data exfiltration, phishing, or other malicious operations.

This vulnerability impacts Red Hat Enterprise Linux 6 through 9, as they include affected WebKitGTK/WPE WebKit components. The precise package versions are not enumerated in the advisory, so any installation of the affected WebKitGTK build is potentially vulnerable. Systems running these distributions should verify whether their WebKitGTK libraries contain the fix.

The CVSS score is 4.7, indicating moderate risk, and the EPSS score is less than 1%, implying a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply or load malicious web content that the application renders; the flaw is likely exploitable only when the application processes untrusted pages. No remote code execution or privilege escalation is provided, so the impact is confined to unauthorized network connections.