CVE-2025-7395 Domain Name Validation Bypass with Apple Native Certificate Validation
Attackers can bypass domain name validation in wolfSSL when using Apple native certificate validation, allowing acceptance of any trusted CA certificate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-7395?
CVE-2025-7395 is a critical vulnerability in wolfSSL, published on 18 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options results in the wolfSSL client failing to properly verify the server certificate's domain name, allowing any certificate issued by a trusted CA to be accepted regardless of the hostname.
Weakness: CWE-295
Which versions are affected by CVE-2025-7395?
How do I fix CVE-2025-7395?
Apply the vendor's patch.
Is CVE-2025-7395 being exploited?
There is no known exploitation of CVE-2025-7395 in the wild and no public exploit code.
Sources
Also known as GHSA-g6x8-5jj7-qqfv, JLSEC-2026-690, UBUNTU-CVE-2025-7395.