CVE-2025-69277 libsodium has Incomplete List of Disallowed Inputs
libsodium mishandles elliptic curve point validation in custom cryptography scenarios, potentially allowing invalid points and bypassing security checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-69277?
CVE-2025-69277 is a medium-severity vulnerability in libsodium, published on 31 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.
Weakness: CWE-184
Which versions are affected by CVE-2025-69277?
10 open source packages ship an affected version, including paragonie/sodium_compat, PyNaCl and hdwallet.
| Package | Affected | Fixed in |
|---|---|---|
paragonie/sodium_compat Packagist | All versions | 1.24.0 |
paragonie/sodium_compat Packagist | All versions | 1.24.0 |
paragonie/sodium_compat Packagist | From 2 | 2.5.0 |
paragonie/sodium_compat Packagist | From 2 | 2.5.0 |
PyNaCl PyPI | All versions | 1.6.2 |
hdwallet PyPI | All versions | 3.6.1 |
4 more packages
hdwallet PyPI | All versions | 3.6.1 |
hdwallet PyPI | All versions | 3.6.1 |
pynacl PyPI | All versions | 1.6.2 |
pynacl PyPI | All versions | 1.6.2 |
Linux distribution packages (6)
libsodium Red Hat:hummingbird:1 | All versions | 0:1.0.22-1.hum1 |
libsodium-devel Red Hat:hummingbird:1 | All versions | 0:1.0.22-1.hum1 |
libsodium-static Red Hat:hummingbird:1 | All versions | 0:1.0.22-1.hum1 |
mingw32-libsodium Red Hat:hummingbird:1 | All versions | 0:1.0.22-1.hum1 |
mingw64-libsodium Red Hat:hummingbird:1 | All versions | 0:1.0.22-1.hum1 |
python-PyNaCl openSUSE:Tumbleweed | All versions | 1.6.2-1.1 |
How do I fix CVE-2025-69277?
Upgrade paragonie/sodium_compat to a fixed version for your release line: 1.24.0 or 2.5.0.
Is CVE-2025-69277 being exploited?
There is no known exploitation of CVE-2025-69277 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-69277, AZL-73341, AZL-73376, BELL-CVE-2025-69277, CLEANSTART-2026-TU07064, CLEANSTART-2026-UY41543 and 28 more.