This vulnerability occurs in GnuTLS version 3.8.13 and causes legitimate Certificate Authority certificates to be incorrectly rejected during the TLS handshake. The faulty validation logic results in the termination of secure connections, effectively creating a denial‑of‑service condition for any client or server relying on that library. The weakness can be classified as a resource‑exhaustion flaw (CWE‑400) because it can lead to repeated handshake failures that drain server resources.

Systems that include GnuTLS 3.8.13 are affected, regardless of vendor. Commonly impacted platforms are Linux distributions and software packages that embed this library, such as web servers, mail servers, or VPN clients that use GnuTLS for TLS transport.

The EPSS score is < 1%. The CVSS score of 5.9 indicates a moderate‑severity vulnerability, and it is not listed in the CISA KEV catalog, so the likelihood of widespread exploitation is uncertain. The attack vector is likely remote, through normal network traffic that triggers a TLS handshake. An attacker can induce the failure simply by connecting to a GnuTLS‑based service, causing repeated handshake failures that can exhaust server resources and disrupt availability.