CVE-2025-7395: Domain Name Validation Bypass with Apple Native Certificate Validation
A certificate verification error in wolfSSL when building with the WOLFSSLSYSCACERTS and WOLFSSLAPPLENATIVECERTVALIDATION options results in the wolfSSL client failing to properly verify the server certificate's domain name, allowing any certificate issued by a trusted CA to be accepted regardless of the hostname.
Other sources
Domain Name Validation Bypass with Apple Native Certificate Validation
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wolfSSLto a version that resolves this vulnerability.Patch fbc483e23a3e42d5430a838230db1f8c90b88d41
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7395?
CVE-2025-7395 has a medium severity level due to the potential for certificate verification failures.
How do I fix CVE-2025-7395?
Fix CVE-2025-7395 by ensuring your wolfSSL configuration uses proper domain name verification methods and updating to the latest version.
What does CVE-2025-7395 affect?
CVE-2025-7395 affects the wolfSSL library when built with specific options that disable proper domain verification.
Can CVE-2025-7395 lead to security issues?
Yes, CVE-2025-7395 can allow man-in-the-middle attacks if an attacker presents an invalid certificate that is otherwise trusted.
Which versions of wolfSSL are impacted by CVE-2025-7395?
CVE-2025-7395 impacts all versions of wolfSSL built with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options.