CVSS 3.1
4.5 mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:NCVE-2025-69277
Medium (4.5). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in paragonie/sodium_compat 1.24.0, 2.5.0.
libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-31)
- CWE
- CWE-184
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mrfv-m5wm-5w6w | Packagist | paragonie/sodium_compat | >=2 <2.5.0 | 2.5.0 |
| GHSA-mrfv-m5wm-5w6w | Packagist | paragonie/sodium_compat | <1.24.0 | 1.24.0 |
| GHSA-mrfv-m5wm-5w6w | PyPI | pynacl | <1.6.2 | 1.6.2 |
| GHSA-mrfv-m5wm-5w6w | PyPI | hdwallet | <3.6.1 | 3.6.1 |
| PYSEC-2026-1448 | PyPI | hdwallet | <3.6.1 | 3.6.1 |
| PYSEC-2026-3002 | PyPI | pynacl | <1.6.2 | 1.6.2 |
References
- https://00f.net/2025/12/30/libsodium-vulnerability/
- https://github.com/jedisct1/libsodium/commit/ad3004ec8731730e93fcfbbc824e67eadc1c1bae
- https://github.com/pyca/pynacl/commit/96314884d88d1089ff5f336dba61d7abbcddbbf7
- https://github.com/pyca/pynacl/commit/ecf41f55a3d8f1e10ce89c61c4b4d67f3f4467cf
- https://github.com/pyca/pynacl/issues/920