A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of "nameConstraints" labels, specifically for "dNSName" (DNS) or "rfc822Name" (email) constraints within "excludedSubtrees" or "permittedSubtrees". A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.