This vulnerability arises from an incorrect behavior order in gnutls when handling multi-record OCSP responses during TLS handshakes. A remote attacker could exploit this by presenting a specially crafted OCSP response, causing clients that verify OCSP status to accept revoked server certificates. This compromises the trust model of TLS connections relying on OCSP validation. The issue affects Red Hat Enterprise Linux 10 and was published on April 30, 2026. The CVSS 3.1 base score is 3.7, reflecting low impact primarily on confidentiality with no impact on integrity or availability.

The vulnerability allows a remote attacker to potentially bypass OCSP revocation checks, leading to acceptance of revoked server certificates. This could result in a compromised trust relationship during TLS sessions, possibly enabling man-in-the-middle scenarios or other trust-based attacks. However, the impact is limited to confidentiality and is rated low severity. There are no known exploits in the wild as of the publication date.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-3832 for current remediation guidance. No explicit patch or workaround information is provided in the available vendor advisory content. Users should monitor the vendor advisory for updates and apply any official fixes once released.