A flaw in GnuTLS allows an oversized Subject Alternative Name to cause the validation process to fall back to checking the Common Name field. This leads to a bypass of certificate validation, permitting an attacker to spoof a legitimate server or perform a man‑in‑the‑middle attack.

Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4 are affected as the GnuTLS library bundled with these distributions contains the flaw. No explicit version ranges are disclosed in the advisory.

The vulnerability receives a CVSS score of 8.2, indicating high severity, while EPSS is unavailable and the issue is not listed in CISA KEV. Based on the description, the likely attack vector is remote: an attacker supplies a certificate with an oversized SAN, causing GnuTLS to ignore the SAN and incorrectly use the CN for validation. The flaw is classified as CWE‑1284, an overly lenient certificate validation weakness, and if exploited the attacker can impersonate a trusted server or intercept encrypted traffic.