A vulnerability in cabal-install's implementation of the Hackage Security protocol caused it to skip verification of the key policy file's expiration timestamp. This flaw could allow an attacker with a revoked private key and the ability to perform a man-in-the-middle attack to deliver malicious packages. No operational keys have been revoked to date, so this remains a theoretical attack. The issue is fixed in cabal-install version 3.10.2.0.