CVE-2025-61727
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.
- Published Dec 3, 2025
- CVSS 6.5 medium
- 0.3% chance of exploitation in the next 30 days (EPSS)
- A fix is available