PT-2025-54285 · Libsodium+4 · Libsodium+4

Frank Denis · Published 2025-01-01 · Updated 2026-05-12 · CVE-2025-69277

Positive Technologies (AI Summary)

CVSS v3.1

4.5

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions libsodium versions prior to ad3004e

Description The software mishandles checks for the validity of elliptic curve points in specific, unusual scenarios. This occurs when custom cryptography or untrusted data is used with the crypto core ed25519 is valid point function, potentially allowing points that are not part of the main cryptographic group.

Recommendations Update to version ad3004e or later.

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

AZL-73341

AZL-73376

BDU:2026-02383

CVE-2025-69277

DLA-4435-1

DSA-6094-1

GHSA-MRFV-M5WM-5W6W

MGASA-2026-0004

OESA-2026-1097

OESA-2026-1098

OESA-2026-1099

OESA-2026-1100

OESA-2026-1101

OESA-2026-1102

OESA-2026-1557

OPENSUSE-SU-2026:10130-1

OPENSUSE-SU-2026:20642-1

OPENSUSE-SU-2026:20650-1

RHSA-2026:7369

SUSE-SU-2026:0368-1

SUSE-SU-2026:0482-1

SUSE-SU-2026:20448-1

SUSE-SU-2026:20484-1

SUSE-SU-2026:21393-1

SUSE-SU-2026:21422-1

SUSE-SU-2026:21431-1

USN-7949-1

Affected Products

Debian

Linuxmint

Red Os

Ubuntu

Libsodium

References · 82

• https://osv.dev/vulnerability/SUSE-SU-2026:0368-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20484-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7949-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-69277 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20448-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0482-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02383 · Security Note
• https://osv.dev/vulnerability/AZL-73341 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2026-0004 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0305SE38 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10130-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-6094-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1097 · Vendor Advisory