The vulnerability in openHiTLS 0.2.0 through 0.3.2 affects the X.509 certificate chain verification process. Specifically, the software only verifies the basic constraints extension and CA flag for intermediate CAs if the certificates are version 3. Certificates of version 1 or 2 bypass these checks, potentially allowing an attacker to exploit this oversight to present improperly validated intermediate CA certificates.

Improper validation of intermediate CA certificates may allow attackers to bypass certificate chain validation, potentially enabling man-in-the-middle attacks or unauthorized certificate acceptance. However, no active exploits are known in the wild, and the exact impact depends on how the software is used in practice.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when relying on openHiTLS for certificate validation, especially with certificates that may include version 1 or 2 intermediate CAs.