CVE-2025-69277

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

This advisoory lists packages in the GitHub Advisory Database's supported ecosystems that are affected by this vulnerability due to a vulnerable dependency.

Sodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable6, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further.

Security Fix(es):

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.(CVE-2025-69277)

Sodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable6, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further.

Security Fix(es):

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.(CVE-2025-69277)

Sodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable6, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further.

Security Fix(es):

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.(CVE-2025-69277)

Sodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable6, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further.

Security Fix(es):

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.(CVE-2025-69277)

Sodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable6, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further.

Security Fix(es):

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.(CVE-2025-69277)

Sodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable6, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further.

Security Fix(es):

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.(CVE-2025-69277)

Sodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable6, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further.

Security Fix(es):

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.(CVE-2025-69277)

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

This advisoory lists packages in the GitHub Advisory Database's supported ecosystems that are affected by this vulnerability due to a vulnerable dependency.

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

This advisoory lists packages in the GitHub Advisory Database's supported ecosystems that are affected by this vulnerability due to a vulnerable dependency.

Root has patched CVE-2025-69277 in the PyNaCl package for Root:PyPI. Multiple fixed versions available.

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

Libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group. (CVE-2025-69277)

These are all security issues fixed in the python311-PyNaCl-1.6.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for libsodium fixes the following issues:

Security fixes:

• CVE-2025-15444: Cryptographic bypass via improper elliptic curve point validation (bsc#1256070).
• CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point function (bsc#1255764).

Other fixes:

• Update to 1.0.21

• The new crypto_ipcrypt_* functions implement mechanisms for securely encrypting and anonymizing IP addresses.
• The sodium_bin2ip and sodium_ip2bin helper functions have been added to complement the crypto_ipcrypt_* functions and easily convert addresses between bytes and strings.
• XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are
• standard extendable output functions. From input of any length, they can derive output of any length with the same properties as hash functions. These primitives are required by many post-quantum mechanisms, but can also be used for a wide range of applications, including key derivation, session encryption and more.
• Performance of AES256-GCM and AEGIS on ARM has been improved with some compilers
• Security: optblockers have been introduced in critical code paths to prevent compilers from introducing unwanted side channels via conditional jumps. This was observed on RISC-V targets with specific compilers and options.
• Security: crypto_core_ed25519_is_valid_point() now properly rejects small-order points that are not in the main subgroup
• ((nonnull)) attributes have been relaxed on some crypto_stream* functions to allow NULL output buffers when the output length is zero
• A cross-compilation issue with old clang versions has been fixed
• crypto_aead_aes256gcm_is_available is exported to JavaScript
• Security: memory fences have been added after MAC verification in AEAD to prevent speculative access to plaintext before authentication is complete
• Assembly files now include .gnu.property notes for proper IBT and Shadow Stack support when building with CET instrumentation.

This update for python-PyNaCl fixes the following issues:

Security fixes:

• CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point function (bsc#1255764).

Other fixes:

• update to 1.6.2 (bsc#1255764, CVE-2025-69277):

• Updated libsodium to 1.0.20-stable (2025-12-31 build)

• Update to 1.6.1

• The MAKE environment variable can now be used to specify the make binary that should be used in the build process.

• update to 1.6.0:

• BACKWARDS INCOMPATIBLE: Removed support for Python 3.6 and 3.7.
• Added support for the low level AEAD AES bindings.
• Added support for crypto_core_ed25519_from_uniform.
• Update libsodium to 1.0.20-stable (2025-08-27 build).
• Added support for free-threaded Python 3.14.
• Added support for Windows on ARM wheels.

• Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• python-PyNaCl requires python-cffi [bsc#1161557]

This update for libsodium fixes the following issues:

• CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).
• CVE-2025-69277: Fixed incorrect validation of elliptic curve points in crypto_core_ed25519_is_valid_point function (bsc#1255764).

This update for libsodium fixes the following issues:

• CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).
• CVE-2025-69277: Fixed incorrect validation of elliptic curve points in crypto_core_ed25519_is_valid_point function (bsc#1255764).

This update for libsodium fixes the following issues:

• CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).
• CVE-2025-69277: Fixed incorrect validation of elliptic curve points in crypto_core_ed25519_is_valid_point function (bsc#1255764).

This update for libsodium fixes the following issues:

• CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).
• CVE-2025-69277: Fixed incorrect validation of elliptic curve points in crypto_core_ed25519_is_valid_point function (bsc#1255764).

This update for libsodium fixes the following issues:

Security fixes:

• CVE-2025-15444: Cryptographic bypass via improper elliptic curve point validation (bsc#1256070).
• CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point function (bsc#1255764).

Other fixes:

• Update to 1.0.21

• The new crypto_ipcrypt_* functions implement mechanisms for securely encrypting and anonymizing IP addresses.
• The sodium_bin2ip and sodium_ip2bin helper functions have been added to complement the crypto_ipcrypt_* functions and easily convert addresses between bytes and strings.
• XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are
• standard extendable output functions. From input of any length, they can derive output of any length with the same properties as hash functions. These primitives are required by many post-quantum mechanisms, but can also be used for a wide range of applications, including key derivation, session encryption and more.
• Performance of AES256-GCM and AEGIS on ARM has been improved with some compilers
• Security: optblockers have been introduced in critical code paths to prevent compilers from introducing unwanted side channels via conditional jumps. This was observed on RISC-V targets with specific compilers and options.
• Security: crypto_core_ed25519_is_valid_point() now properly rejects small-order points that are not in the main subgroup
• ((nonnull)) attributes have been relaxed on some crypto_stream* functions to allow NULL output buffers when the output length is zero
• A cross-compilation issue with old clang versions has been fixed
• crypto_aead_aes256gcm_is_available is exported to JavaScript
• Security: memory fences have been added after MAC verification in AEAD to prevent speculative access to plaintext before authentication is complete
• Assembly files now include .gnu.property notes for proper IBT and Shadow Stack support when building with CET instrumentation.

This update for libsodium fixes the following issues:

Security fixes:

• CVE-2025-15444: Cryptographic bypass via improper elliptic curve point validation (bsc#1256070).
• CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point function (bsc#1255764).

Other fixes:

• Update to 1.0.21

• The new crypto_ipcrypt_* functions implement mechanisms for securely encrypting and anonymizing IP addresses.
• The sodium_bin2ip and sodium_ip2bin helper functions have been added to complement the crypto_ipcrypt_* functions and easily convert addresses between bytes and strings.
• XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are
• standard extendable output functions. From input of any length, they can derive output of any length with the same properties as hash functions. These primitives are required by many post-quantum mechanisms, but can also be used for a wide range of applications, including key derivation, session encryption and more.
• Performance of AES256-GCM and AEGIS on ARM has been improved with some compilers
• Security: optblockers have been introduced in critical code paths to prevent compilers from introducing unwanted side channels via conditional jumps. This was observed on RISC-V targets with specific compilers and options.
• Security: crypto_core_ed25519_is_valid_point() now properly rejects small-order points that are not in the main subgroup
• ((nonnull)) attributes have been relaxed on some crypto_stream* functions to allow NULL output buffers when the output length is zero
• A cross-compilation issue with old clang versions has been fixed
• crypto_aead_aes256gcm_is_available is exported to JavaScript
• Security: memory fences have been added after MAC verification in AEAD to prevent speculative access to plaintext before authentication is complete
• Assembly files now include .gnu.property notes for proper IBT and Shadow Stack support when building with CET instrumentation.

This update for python-PyNaCl fixes the following issues:

Security fixes:

• CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point function (bsc#1255764).

Other fixes:

• update to 1.6.2 (bsc#1255764, CVE-2025-69277):

• Updated libsodium to 1.0.20-stable (2025-12-31 build)

• Update to 1.6.1

• The MAKE environment variable can now be used to specify the make binary that should be used in the build process.

• update to 1.6.0:

• BACKWARDS INCOMPATIBLE: Removed support for Python 3.6 and 3.7.
• Added support for the low level AEAD AES bindings.
• Added support for crypto_core_ed25519_from_uniform.
• Update libsodium to 1.0.20-stable (2025-08-27 build).
• Added support for free-threaded Python 3.14.
• Added support for Windows on ARM wheels.

• Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)
• python-PyNaCl requires python-cffi [bsc#1161557]

This update for libsodium fixes the following issues:

Update to 1.0.22 (jsc#PED-16890):

• Post-quantum key encapsulation is now available. ML-KEM768, the NIST-standardized lattice-based KEM, is accessible through the crypto_kem_mlkem768_*() functions.
• X-Wing, a hybrid KEM combining ML-KEM768 with X25519 for protection against both classical and quantum adversaries, is available through the crypto_kem_*() functions. X-Wing is the recommended KEM for most applications.
• SHA-3 hash functions are now available as crypto_hash_sha3256_() and crypto_hash_sha3512_(), with both one-shot and streaming APIs.
• Performance: NEON optimizations for Argon2 on ARM platforms.
• Performance: SHA3 (Keccak1600) now leverages ARM SHA3 instructions when available on ARM platforms.
• Performance: WebAssembly SIMD implementations of Argon2 have been added.
• XOF state alignment has been relaxed.
• crypto_core_keccak1600_state has been added.
• Export missing crypto_ipcrypt_nd_keygen() helper function.
• crypto_auth_hmacsha256_init and crypto_auth_hmacsha512_init now accept NULL key pointers (with a zero key length), for consistency with other _init functions.
• Fixed compilation with GCC on aarch64 and gcc 4.x.
• On aarch64, aes256-gcm is now enabled even when not using clang, including MSVC.
• Libsodium can be directly used as a dependency in a Zig project.

Update to 1.0.21 (bsc#1256070, CVE-2025-15444, bsc#1255764, CVE-2025-69277):

• The new crypto_ipcrypt_* functions implement mechanisms for securely encrypting and anonymizing IP addresses.
• The sodium_bin2ip and sodium_ip2bin helper functions have been added to complement the crypto_ipcrypt_* functions and easily convert addresses between bytes and strings.
• XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are
• standard extendable output functions. From input of any length, they can derive output of any length with the same properties as hash functions. These primitives are required by many post-quantum mechanisms, but can also be used for a wide range of applications, including key derivation, session encryption and more.
• Performance of AES256-GCM and AEGIS on ARM has been improved with some compilers
• Security: optblockers have been introduced in critical code paths to prevent compilers from introducing unwanted side channels via conditional jumps. This was observed on RISC-V targets with specific compilers and options.
• Security: crypto_core_ed25519_is_valid_point() now properly rejects small-order points that are not in the main subgroup
• ((nonnull)) attributes have been relaxed on some crypto_stream* functions to allow NULL output buffers when the output length is zero
• A cross-compilation issue with old clang versions has been fixed
• crypto_aead_aes256gcm_is_available is exported to JavaScript
• Security: memory fences have been added after MAC verification in AEAD to prevent speculative access to plaintext before authentication is complete
• Assembly files now include .gnu.property notes for proper IBT and Shadow Stack support when building with CET instrumentation.

Update to 1.0.20:

• build system updates and portability fixes

Includes changes from 1.0.19:

• New AEADs: AEGIS-128L and AEGIS-256

• The HKDF key derivation mechanism, required by many standard

  protocols

• A test designed to trigger an OOM condition didn't work on Linux systems with memory overcommit turned on. It has been
• Emscripten: UTF8ToString() is now exported since
• New target: WebAssembly/WASI
• New functions to map a hash to an edwards25519 point or get a random point:
• crypto_core_ed25519_scalar_mul() has been implemented for
• Support for the Ristretto group has been implemented for
• Bug fix: sodium_pad() didn't properly support block sizes
• JS/WebAssembly: some old iOS versions can't…

It was discovered that Sodium incorrectly handled the elliptic curve point validity check in certain atypical use cases. This could result in invalid points being used, contrary to expectations.