Back to Database
Status published
Medium
CVE-2025-69277
libsodium before ad3004e, in atypical use cases involving certain custom...
Vulnerability Description
libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-69277
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/jedisct1/libsodium/commit/ad3004ec8731730e93fcfbbc824e67eadc1c1bae
- https://00f.net/2025/12/30/libsodium-vulnerability/
- https://news.ycombinator.com/item?id=46435614
- https://ianix.com/pub/ed25519-deployment.html
- https://github.com/pyca/pynacl/issues/920
- https://github.com/pyca/pynacl/commit/ecf41f55a3d8f1e10ce89c61c4b4d67f3f4467cf
- https://github.com/pyca/pynacl/commit/96314884d88d1089ff5f336dba61d7abbcddbbf7
Affected Vendor
libsodium
View all reports →Affected Software
libsodium
Vulnerable Versions:
0
Timeline
Official Publish:
December 31st, 2025
Last Modified:
January 7th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.