A flaw in GnuTLS allows an oversized Subject Alternative Name to cause the validation process to fall back to the Common Name (CN) field. This bypasses proper certificate validation, permitting an attacker to spoof a legitimate server or perform a man‑in‑the‑middle attack.

Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 are affected as the GnuTLS library bundled with these distributions contains the flaw. No explicit version ranges are disclosed in the advisory.

The vulnerability receives a CVSS score of 8.2, indicating high severity, while the EPSS score of < 1% shows a very low but nonzero probability of exploitation. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote: an attacker supplies a certificate with an oversized SAN, causing GnuTLS to ignore the SAN and incorrectly use the CN for validation. The flaw is classified as CWE-295, indicating weaknesses in certificate validation logic, and if exploited the attacker can impersonate a trusted server or intercept encrypted traffic.