CVE-2025-69277
Medium
Description
libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.
SeverityMedium
CVSS4.5
Exploit probability—
ProductParagonie/sodium Compat
PublishedDec 31, 2025
First seenDec 31, 2025
Weakness typeCWE-184CWE-184
How to fix
Update
- paragonie/sodium_compat2.5.0, 1.24.0 or later
- pynacl1.6.2 or later
- hdwallet3.6.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| paragonie/sodium_compatPackagist | 2 ≤ v < 2.5.0, v < 1.24.0 | 2.5.0, 1.24.0 |
| pynaclPyPI | v < 1.6.2 | 1.6.2 |
| hdwalletPyPI | v < 3.6.1 | 3.6.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.