Skip to content
Fencer Vulns
medium 4.5

CVE-2025-69277 json

libsodium has Incomplete List of Disallowed Inputs

published 2025-12-31 10 mo ago modified 2026-09-10 1 mo ago also GHSA-mrfv-m5wm-5w6w , PYSEC-2026-1448 , PYSEC-2026-3002 , EUVD-2025-205876

cvss
4.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits
0
none known

Summary

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

Patch / fix

  • packagist paragonie/sodium_compat 1.24.0, 2.5.0
  • pypi pynacl 1.6.2
  • pypi hdwallet 3.6.1
  • libsodium Debian 12 1.0.18-1+deb12u1
  • libsodium Debian 13 1.0.18-1+deb13u1
  • libsodium Debian 14 1.0.18-2

debian advisories DEBIAN-CVE-2025-69277

  • libsodium Ubuntu 22.04 LTS 1.0.18-1ubuntu0.22.04.1
  • libsodium Ubuntu 24.04 LTS 1.0.18-1ubuntu0.24.04.1
  • libsodium Ubuntu 25.10 1.0.18-1ubuntu0.25.10.1

ubuntu advisories UBUNTU-CVE-2025-69277

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libsodium hummingbird 1 1.0.22-1.hum1
  • mingw32-libsodium hummingbird 1 1.0.22-1.hum1
  • mingw64-libsodium hummingbird 1 1.0.22-1.hum1

red hat advisories RHSA-2026:7369

  • libsodium SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +11 more 1.0.22-150000.4.17.1
  • php7 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +7 more 7.4.33-150400.4.75.2
  • zeromq SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +11 more 4.2.3-150000.3.17.1
  • dnsdist SLE Module for Basesystem 15 SP7 1.9.12-150700.3.11.2
  • dnsdist SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +7 more 1.8.0-150400.9.8.1
  • unbound SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Package Hub 15 SP7 +1 more 1.25.2-150600.23.21.4
  • php7-fpm SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +6 more 7.4.33-150400.4.75.1
  • usbguard SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES 15 SP6-LTSS +4 more 1.1.2-150500.6.2.2

suse advisories SUSE-SU-2026:4368-1SUSE-SU-2026:20484-1SUSE-SU-2026:20448-1SUSE-SU-2026:0482-1SUSE-SU-2026:0368-1

  • python-PyNaCl openSUSE Tumbleweed 1.6.2-1.1

opensuse advisories openSUSE-SU-2026:10130-1

  • libsodium Alpine 3.20 1.0.19-r1
  • libsodium Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 1.0.20-r1
  • py3-pynacl Alpine 3.24, Alpine 3.23 1.6.2-r0

alpine advisories ALPINE-CVE-2025-69277

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libsodium Azure Linux 3.0 1.0.19-2
  • libsodium CBL-Mariner 2.0 1.0.18-7

azure linux advisories AZL-73341AZL-73376

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-69277 updated cvss 4.5

libsodium: pynacl: libsodium: Improper validation of elliptic curve points could lead to data integrity or information disclosure.

  • Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-hook-runner-rhel8 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/pilot-rhel8, openshift-service-mesh/grafana-rhel8, openshift-service-mesh/proxyv2-rhel9, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/ratelimit-rhel8, openshift-service-mesh/istio-rhel8-operator, +2 more Red Hat Ansible Automation Platform 2 automation-controller, ansible-automation-platform/ee-minimal-rhel8, ansible-automation-platform/ee-minimal-rhel9, ansible-automation-platform-26/mcp-tools-rhel9, ansible-automation-platform-24/de-minimal-rhel8, ansible-automation-platform-24/de-minimal-rhel9, +34 more Red Hat Ansible Automation Platform Ansible Core 2 ansible-automation-platform/ee-minimal-rhel8, ansible-automation-platform/ee-minimal-rhel9, ansible-automation-platform-tech-preview/ee-minimal-rhel8, ansible-automation-platform-tech-preview/ee-minimal-rhel9 Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9 Red Hat Discovery 2 discovery/discovery-server-rhel9
    +6 more products
    Red Hat OpenShift AI (RHOAI) rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9, rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9, rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9, rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9, +12 more Red Hat OpenStack Platform 16.2 libsodium, rhosp-rhel8/openstack-mariadb, rhosp-rhel8/openstack-tempest, rhosp-rhel8/openstack-heat-all, rhosp-rhel8/openstack-heat-api, rhosp-rhel8/openstack-nova-api, +44 more Red Hat OpenStack Platform 17.1 libsodium, rhosp-rhel9/openstack-mariadb, rhosp-rhel9/openstack-tempest, rhosp-rhel9/openstack-heat-all, rhosp-rhel9/openstack-heat-api, rhosp-rhel9/openstack-nova-api, +41 more Red Hat OpenStack Platform 18.0 libsodium, rhoso/openstack-tempest-rhel9, rhoso/openstack-heat-api-rhel9, rhoso/openstack-nova-api-rhel9, rhoso/openstack-heat-base-rhel9, rhoso/openstack-nova-base-rhel9, +27 more Red Hat Quay 3 quay/quay-rhel8, quay/quay-rhel9 Red Hat Satellite 6 libsodium, satellite/iop-advisor-engine-rhel9, satellite/iop-insights-engine-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images libsodium 1.0.22-1.hum1, mingw32-libsodium 1.0.22-1.hum1, mingw64-libsodium 1.0.22-1.hum1
    fixed: vendor fix RHSA-2026:7369

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-071-03 updated cvss 4.5

Siemens SIDIS Prime

  • Siemens SIDIS Prime < 4.0.800
    affected: fixed in V4.0.800

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
10 mo ago

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
OSV 3.1 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
GitHub 3.1 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
packagist paragonie/sodium_compat
>=2, <2.5.0
<1.24.0
2.5.0
1.24.0
pypi pynacl
<1.6.2
1.6.2
pypi hdwallet
<3.6.1
3.6.1

Affected products

  • libsodium libsodium

Classification

Weakness
  • CWE-184 Incomplete List of Disallowed Inputs

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.