CVE-2025-69277
CVE-2025-69277
This page contains facts from public vulnerability sources. Check the original advisory before updating.
libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.
CVSS 4.5 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
libsodium
- Versions
- ≥ 0, < ad3004ec8731730e93fcfbbc824e67eadc1c1bae: Affected (git)
No fix published
libsodium Debian:12
- Versions
- 1.0.18-1
- Affected ranges
- ECOSYSTEM: < 1.0.18-1+deb12u1
Update to 1.0.18-1+deb12u1
libsodium Debian:13
- Versions
- 1.0.18-1
- Affected ranges
- ECOSYSTEM: < 1.0.18-1+deb13u1
Update to 1.0.18-1+deb13u1
libsodium Debian:14
- Versions
- 1.0.18-1
- Affected ranges
- ECOSYSTEM: < 1.0.18-2
Update to 1.0.18-2
paragonie/sodium_compat Packagist
- Versions
- v2.0.1
- v2.1.0
- v2.2.0
- v2.3.0
- v2.3.1
- v2.4.0
- Affected ranges
- ECOSYSTEM: ≥ 2, < 2.5.0
Update to 2.5.0
paragonie/sodium_compat Packagist
- Versions
- v0.1.0
- v0.1.1
- v0.2.0
- v0.2.1
- v0.2.2
- v0.3.0
- v0.3.1
- v0.4.0
- v0.5.0
- v0.6.0
- v0.7.0
- v0.8.0
- v0.8.1
- v1.0.0
- v1.0.1
- v1.1.0
- v1.10.0
- v1.10.1
- v1.11.0
- v1.11.1
- v1.11.2
- v1.11.3
- v1.11.4
- v1.12.0
- v1.12.1
- v1.12.2
- v1.13.0
- v1.14.0
- v1.15.0
- v1.15.1
- v1.15.2
- v1.15.3
- v1.15.4
- v1.16.0
- v1.16.1
- v1.17.0
- v1.17.1
- v1.18.0
- v1.18.1
- v1.19.0
- v1.2.0
- v1.20.0
- v1.20.1
- v1.21.0
- v1.21.1
- v1.21.2
- v1.22.0
- v1.23.0
- v1.3.0
- v1.3.1
- v1.4.0
- v1.5.0
- v1.5.1
- v1.5.2
- v1.5.3
- v1.5.4
- v1.5.5
- v1.5.6
- v1.6.0
- v1.6.1
- v1.6.2
- v1.6.3
- v1.6.4
- v1.6.5
- v1.6.6
- v1.7.0
- v1.8.0
- v1.8.1
- v1.9.0
- v1.9.1
- v1.9.2
- v1.9.3
- v1.9.4
- Affected ranges
- ECOSYSTEM: < 1.24.0
Update to 1.24.0
pynacl PyPI
- Versions
- 0.1.0
- 0.2.0
- 0.2.1
- 0.2.2
- 0.2.3
- 0.3.0
- 1.0
- 1.0.1
- 1.1.0
- 1.1.1
- 1.1.2
- 1.2.0
- 1.2.1
- 1.3.0
- 1.4.0
- 1.5.0
- 1.6.0
- 1.6.1
- Affected ranges
- ECOSYSTEM: < 1.6.2
Update to 1.6.2
hdwallet PyPI
- Versions
- 0.1.0
- 0.1.0a1
- 0.1.1
- 0.2.0
- 1.0.0
- 1.0.1
- 1.1.0
- 1.1.1
- 1.2.0
- 1.3.0
- 1.3.1
- 1.3.2
- 2.0.0
- 2.0.0a1
- 2.0.1
- 2.1.0
- 2.1.1
- 2.1.2
- 2.2.0
- 2.2.1
- 3.0.0
- 3.0.1
- 3.1.0
- 3.1.0b1
- 3.1.0b2
- 3.2.0
- 3.2.1
- 3.2.3
- 3.3.0
- 3.4.0
- 3.5.1
- 3.6.0
- Affected ranges
- ECOSYSTEM: < 3.6.1
Update to 3.6.1
libsodium Ubuntu:16.04:LTS
- Versions
- 1.0.3-1
- 1.0.8-5
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libsodium Ubuntu:18.04:LTS
- Versions
- 1.0.13-1
- 1.0.14-1
- 1.0.16-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libsodium Ubuntu:20.04:LTS
- Versions
- 1.0.18-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libsodium Ubuntu:22.04:LTS
- Versions
- 1.0.18-1build1
- 1.0.18-1build2
- Affected ranges
- ECOSYSTEM: < 1.0.18-1ubuntu0.22.04.1
Update to 1.0.18-1ubuntu0.22.04.1
libsodium Ubuntu:24.04:LTS
- Versions
- 1.0.18-1build2
- 1.0.18-1build3
- Affected ranges
- ECOSYSTEM: < 1.0.18-1ubuntu0.24.04.1
Update to 1.0.18-1ubuntu0.24.04.1
libsodium Ubuntu:25.10
- Versions
- 1.0.18-1build3
- Affected ranges
- ECOSYSTEM: < 1.0.18-1ubuntu0.25.10.1
Update to 1.0.18-1ubuntu0.25.10.1
Original sources
- https://github.com/jedisct1/libsodium/commit/ad3004ec8731730e93fcfbbc824e67eadc1c1bae
- https://00f.net/2025/12/30/libsodium-vulnerability/
- https://news.ycombinator.com/item?id=46435614
- https://ianix.com/pub/ed25519-deployment.html
- https://github.com/pyca/pynacl/issues/920
- https://github.com/pyca/pynacl/commit/ecf41f55a3d8f1e10ce89c61c4b4d67f3f4467cf
- https://github.com/pyca/pynacl/commit/96314884d88d1089ff5f336dba61d7abbcddbbf7
- https://lists.debian.org/debian-lts-announce/2026/01/msg00004.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-69277