The vulnerability resides in glib-networking’s GnuTLS backend, where supplying a certificate chain that contains circular issuer relationships triggers an unbounded loop during verification, consuming excessive CPU cycles. This unlimited traversal can stall the process that performs verification, effectively denying service to legitimate requests. The issue is a classic infinite‑loop flaw (CWE‑835).

This flaw affects the bundled glib‑networking package in Red Hat Enterprise Linux 6 through 10, across all releases that ship the GnuTLS backend. Any service or application that employs glib‑networking to validate TLS certificates – for example, web servers, mail servers, or custom network utilities – is potentially vulnerable on these distributions.

The CVSS score of 4.3 classifies the weakness as moderate in severity. The EPSS score is unknown, indicating there is no published data on current exploitation activity. The vulnerability is not listed in CISA’s KEV catalog. Attackers likely exploit this over the network by delivering a crafted certificate chain to a target that verifies certificates; no additional privileges or local access are required once the verification request is received.