The flaw in GnuTLS occurs when a Certificate Authority provides only excluded name constraints; the library incorrectly ignores permitted constraints, allowing a remote attacker to bypass certificate validation. This defect permits the acceptance of forged certificates, potentially enabling spoofing or man‑in‑the‑middle attacks. The weakness falls under CWE‑295, which relates to improper certificate validation during transport layer security. The primary impact is a remote bypass of certificate constraints that can compromise the integrity of secure communications.

All Red Hat distributions that ship the affected GnuTLS version are impacted, including Red Hat Enterprise Linux 10, 6 through 9, Red Hat Hardened Images, and OpenShift Container Platform 4. These products all incorporate the same underlying GnuTLS library that contains the defect.

The CVSS score of 7.4 indicates high severity. The EPSS score is not available, so the exploitation probability cannot be quantified, but the lack of a known exploit in the wild does not diminish the risk. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, with an attacker delivering a crafted TLS client or server that presents an invalid certificate; if the validation logic is bypassed, the attacker can impersonate a legitimate server or intercept encrypted traffic.