A flaw in GnuTLS DTLS handshake parsing permits an attacker to send a malformed DTLS fragment with zero length and a non‑zero offset, which causes an integer underflow during fragment reassembly and results in an out‑of‑bounds read. The vulnerability is remotely exploitable and can lead to an information disclosure or a denial of service by crashing the application or the operating system. It is a classic example of integer underflow (CWE‑191) that undermines memory safety during protocol parsing.

Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 are affected. All installations running the included GnuTLS libraries are vulnerable until updated to a version that implements proper bounds checking for DTLS fragments.

The CVSS score of 7.5 classifies this as a high‑severity vulnerability. Attackers can exploit it over the network by sending crafted DTLS packets; the exact EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Because there is no public proof of exploitation reported at this time, the risk is primarily the high potential for DoS or accidental data leakage if an attacker can reach the vulnerable service.