This vulnerability stems from gnutls performing case‑sensitive comparisons of the nameConstraints field when evaluating DNS or email constraints in excludedSubtrees or permittedSubtrees. An attacker can craft a leaf certificate whose subject alternate names use different casing, causing the constraint check to be bypassed and a certificate that should be rejected to be accepted, potentially leading to unauthorized access or information disclosure.

The flaw is present in Red Hat Enterprise Linux releases 6 through 10, the Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. These systems ship the affected gnutls libraries that lack the necessary case‑insensitive validation.

The CVSS score of 6.5 marks this flaw as a moderate‑severity risk, and it is not yet listed in the CISA KEV catalog. EPSS information is unavailable, so the current exploitation probability is unknown. The attack requires an attacker able to supply a rogue certificate to a TLS endpoint that uses gnutls; the vulnerability is typically exploitable over network services that perform client authentication or validate server certificates. Because the bypass is purely a policy validation issue, it does not involve arbitrary code execution but can grant trust to an otherwise disallowed certificate, enabling credential compromise or man‑in‑the‑middle techniques.