CVE-2025-15444 Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium
An attacker can bypass cryptographic validation checks in specific custom use cases by exploiting improper elliptic curve point validation in the bundled libsodium library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-15444?
CVE-2025-15444 is a critical vulnerability in IAMB Crypt::Sodium::XS, published on 6 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium
libsodium <= 1.0.20 or a version of libsodium released before December 30, 2025 contains a vulnerability documented as CVE-2025-69277 https://www.cve.org/CVERecord?id=CVE-2025-69277 .
The libsodium vulnerability states:
In atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.
0.000042 includes a version of libsodium updated to 1.0.20-stable, released January 3, 2026, which includes a fix for the vulnerability.
Which versions are affected by CVE-2025-15444?
It affects 1 product.
Linux distribution packages (14)
libsodium SUSE:Linux Enterprise Micro 5.2 | All versions | 1.0.18-150000.4.11.1 |
libsodium SUSE:Linux Enterprise Micro 5.3 | All versions | 1.0.18-150000.4.11.1 |
libsodium SUSE:Linux Enterprise Micro 5.4 | All versions | 1.0.18-150000.4.11.1 |
libsodium SUSE:Linux Enterprise Micro 5.5 | All versions | 1.0.18-150000.4.11.1 |
libsodium SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.0.18-150000.4.11.1 |
libsodium SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 1.0.16-1.12.1 |
libsodium SUSE:Linux Enterprise Server 16.0 | All versions | 1.0.20-160000.3.1 |
libsodium SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 1.0.20-160000.3.1 |
libsodium SUSE:Linux Micro 6.0 | All versions | 1.0.18-4.1 |
libsodium SUSE:Linux Micro 6.1 | All versions | 1.0.18-slfo.1.1_2.1 |
libsodium SUSE:Linux Micro 6.2 | All versions | 1.0.20-160000.3.1 |
libsodium openSUSE:Leap 15.6 | All versions | 1.0.18-150000.4.11.1 |
libsodium openSUSE:Leap 16.0 | All versions | 1.0.20-160000.3.1 |
libsodium openSUSE:Tumbleweed | All versions | 1.0.21-1.1 |
Products include Iamb Crypt\.
How do I fix CVE-2025-15444?
Upgrade to a fixed version.
Is CVE-2025-15444 being exploited?
There is no known exploitation of CVE-2025-15444 in the wild and no public exploit code.
Other vulnerabilities in IAMB Crypt::Sodium::XS
Sources
Also known as AZL-73751, AZL-73755, GHSA-38vq-9wrc-xxh4, SUSE-SU-2026:0194-1, SUSE-SU-2026:0223-1, SUSE-SU-2026:20242-1 and 5 more.