A flaw in the gnutls library causes certificate validation to incorrectly fall back to checking DNS hostnames against the Common Name when a certificate contains Uniform Resource Identifier or Service (SRV) Subject Alternative Names. This bug allows a remote attacker to present a specially crafted certificate that can be accepted as valid, effectively spoofing legitimate services and potentially enabling man‑in‑the‑middle attacks or unauthorized disclosure of sensitive data. The weakness is a lack of proper handling of URI and SRV SAN fields (CWE‑295).

The vulnerability is reported to affect a range of Red Hat products, including Red Hat Enterprise Linux from versions 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4. No specific product versions are listed as unaffected or affected; therefore any installation that uses the default gnutls library may be vulnerable.

The CVSS score of 7.1 indicates a high risk to confidentiality, integrity, and availability. The EPSS score is not available, so the current probability of exploitation is unclear, and the issue is not listed in CISA’s KEV catalog. Attackers would need remote access to a TLS client or server that relies on gnutls and the ability to influence the certificate presented during the handshake. Given the breadth of affected RHEL releases and OpenShift, the attack surface is substantial, making the vulnerability potentially exploitable in a wide range of production environments.