{"id":"CVE-2025-15444","aliases":["AZL-73751","AZL-73755","EUVD-2026-0979","GHSA-38vq-9wrc-xxh4","SUSE-SU-2026:0194-1","SUSE-SU-2026:0223-1","SUSE-SU-2026:0368-1","SUSE-SU-2026:0482-1","SUSE-SU-2026:20242-1","SUSE-SU-2026:20354-1","SUSE-SU-2026:20448-1","SUSE-SU-2026:20484-1","SUSE-SU-2026:20756-1","SUSE-SU-2026:20913-1","SUSE-SU-2026:21393-1","SUSE-SU-2026:21422-1","SUSE-SU-2026:4368-1","openSUSE-SU-2026:10022-1","openSUSE-SU-2026:20399-1","openSUSE-SU-2026:20642-1"],"status":"published","title":"Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium","description":"Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium\n\nlibsodium \u003c= 1.0.20 or a version of libsodium released before December 30, 2025 contains a vulnerability documented as CVE-2025-69277  https://www.cve.org/CVERecord?id=CVE-2025-69277 .\n\nThe libsodium vulnerability states:\n\nIn atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.\n\n0.000042 includes a version of libsodium updated to 1.0.20-stable, released January 3, 2026, which includes a fix for the vulnerability.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0027,"percentile":0.19481,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1395","CWE-347"],"published":"2026-01-06T00:22:50Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"libsodium","fixed_in":["1.0.19-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libsodium","fixed_in":["1.0.18-7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"libsodium","fixed_in":["1.0.16-1.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libsodium","fixed_in":["1.0.18-150000.4.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libsodium","fixed_in":["1.0.18-150000.4.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libsodium","fixed_in":["1.0.18-150000.4.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsodium","fixed_in":["1.0.18-150000.4.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libsodium","fixed_in":["1.0.18-150000.4.11.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"libsodium","fixed_in":["1.0.18-150000.4.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"libsodium","fixed_in":["1.0.18-4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"libsodium","fixed_in":["1.0.18-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"libsodium","fixed_in":["1.0.20-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libsodium","fixed_in":["1.0.20-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libsodium","fixed_in":["1.0.20-160000.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libsodium","fixed_in":["1.0.21-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"libsodium","fixed_in":["1.0.20-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.19-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16-1.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.11.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16-1.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-slfo.1.1_3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.20-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.20-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.20-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.12-150700.3.11.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150600.23.21.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150500.6.2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"php7-embed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"php7-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150600.23.21.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150400.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150400.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150500.6.2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150500.6.2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150400.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150500.6.2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150600.23.21.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150500.6.2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150400.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150500.6.2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150600.23.21.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150500.6.2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.21-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.20-160000.3.1"}]}]}],"products":[{"vendor":"iamb","product":"crypt::sodium::xs"},{"vendor":"iamb","product":"crypt\\"}],"references":[{"url":"https://github.com/jedisct1/libsodium/commit/ad3004ec8731730e93fcfbbc824e67eadc1c1bae","tags":["Patch","fix"]},{"url":"https://00f.net/2025/12/30/libsodium-vulnerability/","tags":["Third Party Advisory","web"]},{"url":"https://metacpan.org/dist/Crypt-Sodium-XS/changes","tags":["release-notes","Product","Release Notes","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15444","tags":["web","advisory"]},{"url":"https://00f.net/2025/12/30/libsodium-vulnerability"},{"url":"https://github.com/advisories/GHSA-38vq-9wrc-xxh4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15444.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260194-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1256070","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15444","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260223-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260368-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255764","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69277","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260482-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620242-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620354-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620448-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620484-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620756-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620913-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621393-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621422-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264368-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-15444","title":"Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium","description":"Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium\n\nlibsodium \u003c= 1.0.20 or a version of libsodium released before December 30, 2025 contains a vulnerability documented as CVE-2025-69277  https://www.cve.org/CVERecord?id=CVE-2025-69277 .\n\nThe libsodium vulnerability states:\n\nIn atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.\n\n0.000042 includes a version of libsodium updated to 1.0.20-stable, released January 3, 2026, which includes a fix for the vulnerability.","status":"published","published":"2026-01-06T00:22:50.114Z","modified":"2026-01-06T19:01:27.678Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T14:32:37.680845Z"}],"euvd":[{"id":"EUVD-2026-0979","description":"Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium\n\nlibsodium \u003c= 1.0.20 or a version of libsodium released before December 30, 2025 contains a vulnerability documented as CVE-2025-69277  https://www.cve.org/CVERecord?id=CVE-2025-69277 .\n\nThe libsodium vulnerability states:\n\nIn atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.\n\n0.000042 includes a version of libsodium updated to 1.0.20-stable, released January 3, 2026, which includes a fix for the vulnerability.","status":"published","published":"2026-01-06T00:22:50Z","modified":"2026-01-06T19:01:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:55.49901Z"}],"ghsa":[{"id":"GHSA-38vq-9wrc-xxh4","title":"Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of...","description":"Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium\n\nlibsodium \u003c= 1.0.20 or a version of libsodium released before December 30, 2025 contains a vulnerability documented as CVE-2025-69277  https://www.cve.org/CVERecord?id=CVE-2025-69277 .\n\nThe libsodium vulnerability states:\n\nIn atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.\n\n0.000042 includes a version of libsodium updated to 1.0.20-stable, released January 3, 2026, which includes a fix for the vulnerability.","status":"published","published":"2026-01-06T03:31:32Z","modified":"2026-03-10T18:32:15Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:06:32.599326Z"}],"nvd":[{"id":"CVE-2025-15444","description":"Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium\n\nlibsodium \u003c= 1.0.20 or a version of libsodium released before December 30, 2025 contains a vulnerability documented as CVE-2025-69277  https://www.cve.org/CVERecord?id=CVE-2025-69277 .\n\nThe libsodium vulnerability states:\n\nIn atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.\n\n0.000042 includes a version of libsodium updated to 1.0.20-stable, released January 3, 2026, which includes a fix for the vulnerability.","status":"published","published":"2026-01-06T01:16:01.24Z","modified":"2026-10-07T10:10:00.213Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:11:55.613137Z"}],"osv":[{"id":"CVE-2025-15444","title":"Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium","description":"Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium\n\nlibsodium \u003c= 1.0.20 or a version of libsodium released before December 30, 2025 contains a vulnerability documented as CVE-2025-69277  https://www.cve.org/CVERecord?id=CVE-2025-69277 .\n\nThe libsodium vulnerability states:\n\nIn atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.\n\n0.000042 includes a version of libsodium updated to 1.0.20-stable, released January 3, 2026, which includes a fix for the vulnerability.","status":"published","published":"2026-01-06T00:22:50.114Z","modified":"2026-10-28T10:59:17.899092488Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"AZL-73751","title":"CVE-2025-15444 affecting package libsodium for versions less than 1.0.19-2","description":"Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium\n\nlibsodium \u003c= 1.0.20 or a version of libsodium released before December 30, 2025 contains a vulnerability documented as CVE-2025-69277  https://www.cve.org/CVERecord?id=CVE-2025-69277 .\n\nThe libsodium vulnerability states:\n\nIn atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.\n\n0.000042 includes a version of libsodium updated to 1.0.20-stable, released January 3, 2026, which includes a fix for the vulnerability.","status":"published","published":"2026-01-06T01:16:01Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.309973Z"},{"id":"AZL-73755","title":"CVE-2025-15444 affecting package libsodium for versions less than 1.0.18-7","description":"Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium\n\nlibsodium \u003c= 1.0.20 or a version of libsodium released before December 30, 2025 contains a vulnerability documented as CVE-2025-69277  https://www.cve.org/CVERecord?id=CVE-2025-69277 .\n\nThe libsodium vulnerability states:\n\nIn atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.\n\n0.000042 includes a version of libsodium updated to 1.0.20-stable, released January 3, 2026, which includes a fix for the vulnerability.","status":"published","published":"2026-01-06T01:16:01Z","modified":"2026-04-21T04:33:59.643443Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"openSUSE-SU-2026:10022-1","title":"libsodium-devel-1.0.21-1.1 on GA media","description":"These are all security issues fixed in the libsodium-devel-1.0.21-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-09T00:00:00Z","modified":"2026-03-23T04:54:21.339157Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20399-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\n- CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n","status":"published","published":"2026-03-19T08:18:59Z","modified":"2026-03-29T17:23:40.715268Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20642-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2025-15444: Cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n- CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to\n  crypto_core_ed25519_is_valid_point function (bsc#1255764).\n\nOther fixes:\n\n- Update to 1.0.21\n * The new crypto_ipcrypt_* functions implement mechanisms for securely\n encrypting and anonymizing IP addresses.\n * The sodium_bin2ip and sodium_ip2bin helper functions have been added to\n complement the crypto_ipcrypt_* functions and easily convert addresses\n between bytes and strings.\n * XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are\n * standard\n extendable output functions. From input of any length, they can derive\n output of any length with the same properties as hash functions. These\n primitives are required by many post-quantum mechanisms, but can also be\n used for a wide range of applications, including key derivation, session\n encryption and more.\n * Performance of AES256-GCM and AEGIS on ARM has been improved with some\n compilers\n * Security: optblockers have been introduced in critical code paths to prevent\n compilers from introducing unwanted side channels via conditional jumps. This\n was observed on RISC-V targets with specific compilers and options.\n * Security: crypto_core_ed25519_is_valid_point() now properly rejects\n small-order points that are not in the main subgroup\n * ((nonnull)) attributes have been relaxed on some crypto_stream* functions to\n allow NULL output buffers when the output length is zero\n * A cross-compilation issue with old clang versions has been fixed\n * crypto_aead_aes256gcm_is_available is exported to JavaScript\n * Security: memory fences have been added after MAC verification in AEAD to\n prevent speculative access to plaintext before authentication is complete\n * Assembly files now include .gnu.property notes for proper IBT and Shadow\n Stack support when building with CET instrumentation.\n","status":"published","published":"2026-04-28T15:27:57Z","modified":"2026-05-01T18:27:06.190126Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0194-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\n- CVE-2025-15444: fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n","status":"published","published":"2026-01-21T09:05:11Z","modified":"2026-03-23T04:51:59.399933Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0223-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\n- CVE-2025-15444: fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n","status":"published","published":"2026-01-22T12:18:02Z","modified":"2026-03-23T04:52:01.712902Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0368-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues: \n\n- CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n- CVE-2025-69277: Fixed incorrect validation of elliptic curve points in crypto_core_ed25519_is_valid_point function (bsc#1255764).\n","status":"published","published":"2026-02-03T13:40:57Z","modified":"2026-03-23T04:52:10.70043Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0482-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues: \n\n- CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n- CVE-2025-69277: Fixed incorrect validation of elliptic curve points in crypto_core_ed25519_is_valid_point function (bsc#1255764).\n","status":"published","published":"2026-02-12T16:04:29Z","modified":"2026-02-13T16:58:53.105925Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:20242-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\n- CVE-2025-15444: missing checks when validating elliptic curve points allows for cryptographic bypass (bsc#1256070).\n","status":"published","published":"2026-01-13T13:09:40Z","modified":"2026-03-23T04:52:46.764276Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20354-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\n- CVE-2025-15444: missing checks when validating elliptic curve points allows for cryptographic bypass (bsc#1256070).\n","status":"published","published":"2026-01-13T13:23:04Z","modified":"2026-03-23T04:53:17.982717Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20448-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\n- CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n- CVE-2025-69277: Fixed incorrect validation of elliptic curve points in crypto_core_ed25519_is_valid_point function (bsc#1255764).\n","status":"published","published":"2026-02-17T08:34:12Z","modified":"2026-03-23T04:52:56.393184Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20484-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\n- CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n- CVE-2025-69277: Fixed incorrect validation of elliptic curve points in crypto_core_ed25519_is_valid_point function (bsc#1255764).\n","status":"published","published":"2026-02-17T09:37:03Z","modified":"2026-03-23T04:52:59.516114Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20756-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\n- CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n","status":"published","published":"2026-03-19T08:17:20Z","modified":"2026-03-25T17:23:42.787872Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20913-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\n- CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n","status":"published","published":"2026-03-19T08:17:20Z","modified":"2026-04-02T17:33:50.245868Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21393-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2025-15444: Cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n- CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to\n  crypto_core_ed25519_is_valid_point function (bsc#1255764).\n\nOther fixes:\n\n- Update to 1.0.21\n * The new crypto_ipcrypt_* functions implement mechanisms for securely\n encrypting and anonymizing IP addresses.\n * The sodium_bin2ip and sodium_ip2bin helper functions have been added to\n complement the crypto_ipcrypt_* functions and easily convert addresses\n between bytes and strings.\n * XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are\n * standard\n extendable output functions. From input of any length, they can derive\n output of any length with the same properties as hash functions. These\n primitives are required by many post-quantum mechanisms, but can also be\n used for a wide range of applications, including key derivation, session\n encryption and more.\n * Performance of AES256-GCM and AEGIS on ARM has been improved with some\n compilers\n * Security: optblockers have been introduced in critical code paths to prevent\n compilers from introducing unwanted side channels via conditional jumps. This\n was observed on RISC-V targets with specific compilers and options.\n * Security: crypto_core_ed25519_is_valid_point() now properly rejects\n small-order points that are not in the main subgroup\n * ((nonnull)) attributes have been relaxed on some crypto_stream* functions to\n allow NULL output buffers when the output length is zero\n * A cross-compilation issue with old clang versions has been fixed\n * crypto_aead_aes256gcm_is_available is exported to JavaScript\n * Security: memory fences have been added after MAC verification in AEAD to\n prevent speculative access to plaintext before authentication is complete\n * Assembly files now include .gnu.property notes for proper IBT and Shadow\n Stack support when building with CET instrumentation.\n","status":"published","published":"2026-04-28T15:28:13Z","modified":"2026-05-01T18:27:08.864469Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21422-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2025-15444: Cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n- CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to\n  crypto_core_ed25519_is_valid_point function (bsc#1255764).\n\nOther fixes:\n\n- Update to 1.0.21\n * The new crypto_ipcrypt_* functions implement mechanisms for securely\n encrypting and anonymizing IP addresses.\n * The sodium_bin2ip and sodium_ip2bin helper functions have been added to\n complement the crypto_ipcrypt_* functions and easily convert addresses\n between bytes and strings.\n * XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are\n * standard\n extendable output functions. From input of any length, they can derive\n output of any length with the same properties as hash functions. These\n primitives are required by many post-quantum mechanisms, but can also be\n used for a wide range of applications, including key derivation, session\n encryption and more.\n * Performance of AES256-GCM and AEGIS on ARM has been improved with some\n compilers\n * Security: optblockers have been introduced in critical code paths to prevent\n compilers from introducing unwanted side channels via conditional jumps. This\n was observed on RISC-V targets with specific compilers and options.\n * Security: crypto_core_ed25519_is_valid_point() now properly rejects\n small-order points that are not in the main subgroup\n * ((nonnull)) attributes have been relaxed on some crypto_stream* functions to\n allow NULL output buffers when the output length is zero\n * A cross-compilation issue with old clang versions has been fixed\n * crypto_aead_aes256gcm_is_available is exported to JavaScript\n * Security: memory fences have been added after MAC verification in AEAD to\n prevent speculative access to plaintext before authentication is complete\n * Assembly files now include .gnu.property notes for proper IBT and Shadow\n Stack support when building with CET instrumentation.\n","status":"published","published":"2026-04-28T15:28:13Z","modified":"2026-05-05T18:23:47.096888Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:4368-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\nUpdate to 1.0.22 (jsc#PED-16890):\n\n  * Post-quantum key encapsulation is now available. ML-KEM768, the\n    NIST-standardized lattice-based KEM, is accessible through the\n    crypto_kem_mlkem768_*() functions.\n  * X-Wing, a hybrid KEM combining ML-KEM768 with X25519 for protection\n    against both classical and quantum adversaries, is available through the\n    crypto_kem_*() functions. X-Wing is the recommended KEM for most\n    applications.\n  * SHA-3 hash functions are now available as crypto_hash_sha3256_*()\n    and crypto_hash_sha3512_*(), with both one-shot and streaming APIs.\n  * Performance: NEON optimizations for Argon2 on ARM platforms.\n  * Performance: SHA3 (Keccak1600) now leverages ARM SHA3 instructions when\n    available on ARM platforms.\n  * Performance: WebAssembly SIMD implementations of Argon2 have been added.\n  * XOF state alignment has been relaxed.\n  * crypto_core_keccak1600_state has been added.\n  * Export missing crypto_ipcrypt_nd_keygen() helper function.\n  * crypto_auth_hmacsha256_init and crypto_auth_hmacsha512_init now\n    accept NULL key pointers (with a zero key length), for consistency with\n    other _init functions.\n  * Fixed compilation with GCC on aarch64 and gcc 4.x.\n  * On aarch64, aes256-gcm is now enabled even when not using clang,\n    including MSVC.\n  * Libsodium can be directly used as a dependency in a Zig project.\n\nUpdate to 1.0.21 (bsc#1256070, CVE-2025-15444, bsc#1255764, CVE-2025-69277):\n\n  * The new crypto_ipcrypt_* functions implement mechanisms for securely\n    encrypting and anonymizing IP addresses.\n  * The sodium_bin2ip and sodium_ip2bin helper functions have been added to\n    complement the crypto_ipcrypt_* functions and easily convert addresses\n    between bytes and strings.\n  * XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are\n  * standard\n    extendable output functions. From input of any length, they can derive\n    output of any length with the same properties as hash functions. These\n    primitives are required by many post-quantum mechanisms, but can also be\n    used for a wide range of applications, including key derivation, session\n    encryption and more.\n  * Performance of AES256-GCM and AEGIS on ARM has been improved with some\n    compilers\n  * Security: optblockers have been introduced in critical code paths to prevent\n    compilers from introducing unwanted side channels via conditional jumps. This\n    was observed on RISC-V targets with specific compilers and options.\n  * Security: crypto_core_ed25519_is_valid_point() now properly rejects\n    small-order points that are not in the main subgroup\n  * ((nonnull)) attributes have been relaxed on some crypto_stream* functions to\n    allow NULL output buffers when the output length is zero\n  * A cross-compilation issue with old clang versions has been fixed\n  * crypto_aead_aes256gcm_is_available is exported to JavaScript\n  * Security: memory fences have been added after MAC verification in AEAD to\n    prevent speculative access to plaintext before authentication is complete\n  * Assembly files now include .gnu.property notes for proper IBT and Shadow\n    Stack support when building with CET instrumentation.\n\nUpdate to 1.0.20:\n\n  * build system updates and portability fixes\n\nIncludes changes from 1.0.19:\n\n  * New AEADs: AEGIS-128L and AEGIS-256\n  * The HKDF key derivation mechanism, required by many standard\n\n    protocols\n  - A test designed to trigger an OOM condition didn't work on\n    Linux systems with memory overcommit turned on. It has been\n  - Emscripten: UTF8ToString() is now exported since\n  - New target: WebAssembly/WASI\n  - New functions to map a hash to an edwards25519 point\n    or get a random point:\n  - crypto_core_ed25519_scalar_mul() has been implemented for\n  - Support for the Ristretto group has been implemented for\n  - Bug fix: sodium_pad() didn't properly support block sizes\n  - JS/WebAssembly: some old iOS versions can't instantiate the\n    crypto_pwhash_scryptsalsa208sha256_str_needs_rehash()didn't\n    returnEINVAL` on input strings with a short length, unlike\n  - Added a workaround for Visual Studio 2010 bug causing CPU\n  - New low-level APIs for arithmetic mod the order of the prime\n  - crypto_core_ed25519_scalar_random(),\n  - crypto_core_ed25519_scalar_invert(),\n  - crypto_core_ed25519_scalar_complement(),\n    crypto_core_ed25519_scalar_add() and\n    crypto_scalarmult_ed25519_base_noclamp() and\n    crypto_scalarmult_ed25519_noclamp().\n\n  * AVX2 detection is more reliable.\n\n    Intel platforms. crypto_generichash() is now faster than MD5 and\n  * In addition to sodium_bin2hex(), sodium_hex2bin() is now a\n  * crypto_generichash_statebytes(), crypto_auth_*_statebytes()\n    and crypto_hash_*_statebytes() have been added in order to\n    retrieve the size of structures keeping states from foreign\n  * The JavaScript target doesn't require /dev/urandom or an\n    external randombytes() implementation any more. Other minor\n    Emscripten-related improvements have been made in order to\n  * Custom randombytes implementations do not need to provide\n    their own implementation of randombytes_uniform() any more.\n    randombytes_stir() and randombytes_close() can also be NULL\n  * On Linux, getrandom(2) is being used instead of directly\n    accessing /dev/urandom, if the kernel supports this system\n\nAlso libsodium users were rebuilt: zeromq, dnsdist, unbound, php7, and usbguard.\n","status":"published","published":"2026-09-28T15:06:19Z","modified":"2026-09-29T09:15:10.902986228Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}