{"id":"CVE-2025-69277","aliases":["ALPINE-CVE-2025-69277","AZL-73341","AZL-73376","BELL-CVE-2025-69277","DEBIAN-CVE-2025-69277","DLA-4435-1","DSA-6094-1","EUVD-2025-205876","GHSA-mrfv-m5wm-5w6w","MGASA-2026-0004","OESA-2026-1097","OESA-2026-1098","OESA-2026-1099","OESA-2026-1100","OESA-2026-1101","OESA-2026-1102","OESA-2026-1557","PYSEC-2026-1448","PYSEC-2026-3002","RHSA-2026:7369","ROOT-APP-PYPI-CVE-2025-69277","SUSE-SU-2026:0368-1","SUSE-SU-2026:0482-1","SUSE-SU-2026:20448-1","SUSE-SU-2026:20484-1","SUSE-SU-2026:21393-1","SUSE-SU-2026:21422-1","SUSE-SU-2026:21431-1","SUSE-SU-2026:4368-1","UBUNTU-CVE-2025-69277","USN-7949-1","openSUSE-SU-2026:10130-1","openSUSE-SU-2026:20642-1","openSUSE-SU-2026:20650-1"],"status":"published","title":"libsodium has Incomplete List of Disallowed Inputs","description":"libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.","severity":{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00182,"percentile":0.07811,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-184"],"published":"2025-12-31T05:50:07Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Packagist","package":"paragonie/sodium_compat","fixed_in":["2.5.0","1.24.0"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"pynacl","fixed_in":["1.6.2"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"hdwallet","fixed_in":["3.6.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.20","package":"libsodium","fixed_in":["1.0.19-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libsodium","fixed_in":["1.0.20-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libsodium","fixed_in":["1.0.20-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libsodium","fixed_in":["1.0.20-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libsodium","fixed_in":["1.0.20-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-pynacl","fixed_in":["1.6.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-pynacl","fixed_in":["1.6.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libsodium","fixed_in":["1.0.19-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"libsodium","fixed_in":["1.0.18-7"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libsodium","fixed_in":["1.0.18-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libsodium","fixed_in":["1.0.20-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libsodium","fixed_in":["1.0.20-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libsodium","fixed_in":["1.0.18-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libsodium","fixed_in":["1.0.18-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libsodium","fixed_in":["1.0.18-2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"libsodium","fixed_in":["1.0.18-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"sodium","fixed_in":["1.0.18-3.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"libsodium","fixed_in":["1.0.18-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libsodium","fixed_in":["1.0.18-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"libsodium","fixed_in":["1.0.19-2.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libsodium","fixed_in":["1.0.19-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"libsodium","fixed_in":["1.0.19-2.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libsodium","fixed_in":["1.0.19-2.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libsodium","fixed_in":["1.0.18-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"libsodium","fixed_in":["0:1.0.22-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"libsodium-devel","fixed_in":["0:1.0.22-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"libsodium-static","fixed_in":["0:1.0.22-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"mingw32-libsodium","fixed_in":["0:1.0.22-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"mingw64-libsodium","fixed_in":["0:1.0.22-1.hum1"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"PyNaCl","fixed_in":["1.5.0+aikido.6","1.5.0+aikido.7","1.5.0+aikido.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libsodium","fixed_in":["1.0.18-1ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libsodium","fixed_in":["1.0.18-1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libsodium","fixed_in":["1.0.18-1ubuntu0.25.10.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-PyNaCl","fixed_in":["1.6.2-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"paragonie/sodium_compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2"},{"fixed":"2.5.0"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"paragonie/sodium_compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"pynacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"hdwallet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.19-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.20-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.20-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.20-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.20-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-pynacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-pynacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.19-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-7"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.18-r2"},{"fixed":"1.0.18-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.20-r0"},{"fixed":"1.0.20-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.18-r0"},{"fixed":"1.0.20-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1+deb12u1"}]}],"versions":["1.0.18-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1+deb13u1"}]}],"versions":["1.0.18-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-2"}]}],"versions":["1.0.18-1"]},{"source":"osv","ecosystem":"Debian:11","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1+deb11u1"}]}],"versions":["1.0.18-1"]},{"source":"osv","ecosystem":"Debian:12","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1+deb12u1"}]}],"versions":["1.0.18-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1+deb13u1"}]}],"versions":["1.0.18-1"]},{"source":"osv","ecosystem":"Packagist","package":"paragonie/sodium_compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2"},{"fixed":"2.5.0"}]}],"versions":["v2.0.1","v2.1.0","v2.2.0","v2.3.0","v2.3.1","v2.4.0"]},{"source":"osv","ecosystem":"Packagist","package":"paragonie/sodium_compat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0"}]}],"versions":["v0.1.0","v0.1.1","v0.2.0","v0.2.1","v0.2.2","v0.3.0","v0.3.1","v0.4.0","v0.5.0","v0.6.0","v0.7.0","v0.8.0","v0.8.1","v1.0.0","v1.0.1","v1.1.0","v1.10.0","v1.10.1","v1.11.0","v1.11.1","v1.11.2","v1.11.3","v1.11.4","v1.12.0","v1.12.1","v1.12.2","v1.13.0","v1.14.0","v1.15.0","v1.15.1","v1.15.2","v1.15.3","v1.15.4","v1.16.0","v1.16.1","v1.17.0","v1.17.1","v1.18.0","v1.18.1","v1.19.0","v1.2.0","v1.20.0","v1.20.1","v1.21.0","v1.21.1","v1.21.2","v1.22.0","v1.23.0","v1.3.0","v1.3.1","v1.4.0","v1.5.0","v1.5.1","v1.5.2","v1.5.3","v1.5.4","v1.5.5","v1.5.6","v1.6.0","v1.6.1","v1.6.2","v1.6.3","v1.6.4","v1.6.5","v1.6.6","v1.7.0","v1.8.0","v1.8.1","v1.9.0","v1.9.1","v1.9.2","v1.9.3","v1.9.4"]},{"source":"osv","ecosystem":"PyPI","package":"pynacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2"}]}],"versions":["0.1.0","0.2.0","0.2.1","0.2.2","0.2.3","0.3.0","1.0","1.0.1","1.1.0","1.1.1","1.1.2","1.2.0","1.2.1","1.3.0","1.4.0","1.5.0","1.6.0","1.6.1"]},{"source":"osv","ecosystem":"PyPI","package":"hdwallet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1"}]}],"versions":["0.1.0","0.1.0a1","0.1.1","0.2.0","1.0.0","1.0.1","1.1.0","1.1.1","1.2.0","1.3.0","1.3.1","1.3.2","2.0.0","2.0.0a1","2.0.1","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","3.0.0","3.0.1","3.1.0","3.1.0b1","3.1.0b2","3.2.0","3.2.1","3.2.3","3.3.0","3.4.0","3.5.1","3.6.0"]},{"source":"osv","ecosystem":"Mageia:9","package":"sodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-3.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.19-2.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.19-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.19-2.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.19-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"hdwallet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1"}]}],"versions":["0.1.0","0.1.0a1","0.1.1","0.2.0","1.0.0","1.0.1","1.1.0","1.1.1","1.2.0","1.3.0","1.3.1","1.3.2","2.0.0","2.0.0a1","2.0.1","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","3.0.0","3.0.1","3.1.0","3.1.0b1","3.1.0b2","3.2.0","3.2.1","3.2.3","3.3.0","3.4.0","3.5.1","3.6.0"]},{"source":"osv","ecosystem":"PyPI","package":"pynacl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2"}]}],"versions":["0.1.0","0.2.0","0.2.1","0.2.2","0.2.3","0.3.0","1.0","1.0.1","1.1.0","1.1.1","1.1.2","1.2.0","1.2.1","1.3.0","1.4.0","1.5.0","1.6.0","1.6.1"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.22-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libsodium-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.22-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libsodium-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.22-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mingw32-libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.22-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mingw64-libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.22-1.hum1"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"PyNaCl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0+aikido.6"},{"fixed":"1.5.0+aikido.7"},{"fixed":"1.5.0+aikido.8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-150000.4.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.16-1.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-slfo.1.1_3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.12-150700.3.11.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150600.23.21.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150500.6.2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP7","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"php7-embed","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"php7-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150600.23.21.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150400.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150400.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150500.6.2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150500.6.2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150400.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150500.6.2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150600.23.21.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150500.6.2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150400.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150500.6.2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"apache2-mod_php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"dnsdist","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150400.9.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-150000.4.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"php7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"php7-fastcgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"php7-fpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.33-150400.4.75.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"unbound","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2-150600.23.21.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"usbguard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-150500.6.2.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"zeromq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-150000.3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.3-1","1.0.8-5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.13-1","1.0.14-1","1.0.16-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.18-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1ubuntu0.22.04.1"}]}],"versions":["1.0.18-1build1","1.0.18-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1ubuntu0.24.04.1"}]}],"versions":["1.0.18-1build2","1.0.18-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1ubuntu0.25.10.1"}]}],"versions":["1.0.18-1build3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1ubuntu0.22.04.1"}]}],"versions":["1.0.18-1build1","1.0.18-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1ubuntu0.24.04.1"}]}],"versions":["1.0.18-1build2","1.0.18-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libsodium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1ubuntu0.25.10.1"}]}],"versions":["1.0.18-1build3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-PyNaCl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1.1"}]}]}],"products":[{"vendor":"libsodium","product":"libsodium"}],"references":[{"url":"https://github.com/jedisct1/libsodium/commit/ad3004ec8731730e93fcfbbc824e67eadc1c1bae","tags":["fix","web","article"]},{"url":"https://00f.net/2025/12/30/libsodium-vulnerability/","tags":["web","article","report"]},{"url":"https://news.ycombinator.com/item?id=46435614","tags":["web","article","report"]},{"url":"https://ianix.com/pub/ed25519-deployment.html","tags":["web","article","report"]},{"url":"https://github.com/pyca/pynacl/issues/920","tags":["report","web"]},{"url":"https://github.com/pyca/pynacl/commit/ecf41f55a3d8f1e10ce89c61c4b4d67f3f4467cf","tags":["fix","web"]},{"url":"https://github.com/pyca/pynacl/commit/96314884d88d1089ff5f336dba61d7abbcddbbf7","tags":["fix","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00004.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69277","tags":["web","advisory"]},{"url":"https://00f.net/2025/12/30/libsodium-vulnerability","tags":["web"]},{"url":"https://github.com/paragonie/sodium_compat/commit/2cb48f26130919f92f30650bdcc30e6f4ebe45ac","tags":["web"]},{"url":"https://github.com/paragonie/sodium_compat/commit/4714da6efdc782c06690bc72ce34fae7941c2d9f","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/paragonie/sodium_compat/2025-12-30.yaml","tags":["web"]},{"url":"https://github.com/hdwallet-io/python-hdwallet/pull/124","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mrfv-m5wm-5w6w","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-69277","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-69277","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69277.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-69277","tags":["advisory"]},{"url":"https://github.com/paragonie/sodium_compat","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2026-0004.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34940","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00002.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1097","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1098","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1099","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1100","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1101","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1102","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1557","tags":["advisory"]},{"url":"https://pypi.org/project/hdwallet","tags":["package"]},{"url":"https://pypi.org/project/pynacl","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7369","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-69277","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7369.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426416","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69277","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260368-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255764","tags":["report"]},{"url":"https://bugzilla.suse.com/1256070","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-69277","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260482-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620448-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620484-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621393-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621422-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621431-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1161557","tags":["report"]},{"url":"https://bugzilla.suse.com/1199282","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264368-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-69277","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7949-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-69277","description":"libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.","status":"published","published":"2025-12-31T05:50:07.422Z","modified":"2026-01-07T17:06:43.302Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T14:32:41.089134Z"}],"euvd":[{"id":"EUVD-2025-205876","description":"libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.","status":"published","published":"2025-12-31T05:50:07Z","modified":"2026-01-07T17:06:43Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:55.108559Z"}],"ghsa":[{"id":"GHSA-mrfv-m5wm-5w6w","title":"libsodium has Incomplete List of Disallowed Inputs","description":"libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.\n\nThis advisoory lists packages in the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database?tab=readme-ov-file#supported-ecosystems) that are affected by this vulnerability due to a vulnerable dependency.","status":"published","published":"2025-12-31T06:30:18Z","modified":"2026-01-07T18:30:24Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T14:39:16.156387Z"}],"nvd":[{"id":"CVE-2025-69277","description":"libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.","status":"published","published":"2025-12-31T06:15:41.513Z","modified":"2026-06-17T10:00:25.26Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T14:11:54.323368Z"}],"osv":[{"id":"ALPINE-CVE-2025-69277","description":"libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.","status":"published","published":"2025-12-31T06:15:41.513Z","modified":"2026-11-03T06:33:01.232961641Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"BELL-CVE-2025-69277","status":"published","published":"2026-01-07T06:07:25.267645Z","modified":"2026-01-26T09:42:23.113652Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:22.77042Z"},{"id":"CVE-2025-69277","description":"libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.","status":"published","published":"2025-12-31T05:50:07.422Z","modified":"2026-10-28T11:06:32.674897991Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T15:44:52.859856Z"},{"id":"DEBIAN-CVE-2025-69277","description":"libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.","status":"published","published":"2025-12-31T06:15:41.513Z","modified":"2026-09-01T20:05:58.462652472Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:48.025964Z"},{"id":"GHSA-mrfv-m5wm-5w6w","title":"libsodium has Incomplete List of Disallowed Inputs","description":"libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.\n\nThis advisoory lists packages in the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database?tab=readme-ov-file#supported-ecosystems) that are affected by this vulnerability due to a vulnerable dependency.","status":"published","published":"2025-12-31T06:30:18Z","modified":"2026-09-10T03:50:32.114968115Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"OESA-2026-1097","title":"libsodium security update","description":"Sodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable6, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further.\r\n\r\nSecurity Fix(es):\n\nlibsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren\u0026apos;t in the main cryptographic group.(CVE-2025-69277)","status":"published","published":"2026-01-16T11:10:08Z","modified":"2026-08-18T01:19:27.266807125Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1098","title":"libsodium security update","description":"Sodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable6, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further.\r\n\r\nSecurity Fix(es):\n\nlibsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren\u0026apos;t in the main cryptographic group.(CVE-2025-69277)","status":"published","published":"2026-01-16T11:10:08Z","modified":"2026-08-18T01:19:27.37403257Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1099","title":"libsodium security update","description":"Sodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable6, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further.\r\n\r\nSecurity Fix(es):\n\nlibsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren\u0026apos;t in the main cryptographic group.(CVE-2025-69277)","status":"published","published":"2026-01-16T11:10:08Z","modified":"2026-08-18T01:19:27.578153793Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1100","title":"libsodium security update","description":"Sodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable6, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further.\r\n\r\nSecurity Fix(es):\n\nlibsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren\u0026apos;t in the main cryptographic group.(CVE-2025-69277)","status":"published","published":"2026-01-16T11:10:08Z","modified":"2026-08-18T01:19:27.618335104Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1101","title":"libsodium security update","description":"Sodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable6, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further.\r\n\r\nSecurity Fix(es):\n\nlibsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren\u0026apos;t in the main cryptographic group.(CVE-2025-69277)","status":"published","published":"2026-01-16T11:10:08Z","modified":"2026-08-18T01:19:27.691685813Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1102","title":"libsodium security update","description":"Sodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable6, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further.\r\n\r\nSecurity Fix(es):\n\nlibsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren\u0026apos;t in the main cryptographic group.(CVE-2025-69277)","status":"published","published":"2026-01-16T11:10:08Z","modified":"2026-08-18T01:19:27.42360684Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1557","title":"libsodium security update","description":"Sodium is a modern, easy-to-use software library for encryption, decryption, signatures, password hashing and more. It is a portable, cross-compilable, installable6, packageable fork of NaCl, with a compatible API, and an extended API to improve usability even further.\r\n\r\nSecurity Fix(es):\n\nlibsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren\u0026apos;t in the main cryptographic group.(CVE-2025-69277)","status":"published","published":"2026-03-15T11:10:33Z","modified":"2026-08-18T01:19:36.304347913Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"PYSEC-2026-1448","title":"libsodium has Incomplete List of Disallowed Inputs","description":"libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.\n\nThis advisoory lists packages in the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database?tab=readme-ov-file#supported-ecosystems) that are affected by this vulnerability due to a vulnerable dependency.","status":"published","published":"2026-07-07T16:03:14.550291Z","modified":"2026-07-13T16:43:23.604670369Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"PYSEC-2026-3002","title":"libsodium has Incomplete List of Disallowed Inputs","description":"libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.\n\nThis advisoory lists packages in the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database?tab=readme-ov-file#supported-ecosystems) that are affected by this vulnerability due to a vulnerable dependency.","status":"published","published":"2026-07-13T14:36:34.230612Z","modified":"2026-07-13T16:43:23.604670369Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:56.429374Z"},{"id":"RHSA-2026:7369","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-25T10:09:35Z","modified":"2026-10-06T10:31:16.086071059Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"ROOT-APP-PYPI-CVE-2025-69277","title":"CVE-2025-69277 in PyNaCl - Patched by Root","description":"Root has patched CVE-2025-69277 in the PyNaCl package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-10-30T12:20:22Z","modified":"2026-10-30T13:15:03.407595613Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"UBUNTU-CVE-2025-69277","description":"libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.","status":"published","published":"2025-12-31T06:15:00Z","modified":"2026-04-22T16:14:12.392555Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"AZL-73341","title":"CVE-2025-69277 affecting package libsodium for versions less than 1.0.19-2","description":"libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.","status":"published","published":"2025-12-31T06:15:41Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.309973Z"},{"id":"AZL-73376","title":"CVE-2025-69277 affecting package libsodium for versions less than 1.0.18-7","description":"libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.","status":"published","published":"2025-12-31T06:15:41Z","modified":"2026-04-21T04:33:52.18515Z","updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"DLA-4435-1","title":"libsodium - security update","status":"published","published":"2026-01-07T00:00:00Z","modified":"2026-01-07T16:15:04.075032Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-6094-1","title":"libsodium - security update","status":"published","published":"2026-01-05T00:00:00Z","modified":"2026-01-05T20:15:11.033935Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2026-0004","title":"Updated sodium packages fix security vulnerability","description":"Libsodium before ad3004e, in atypical use cases involving certain custom\ncryptography or untrusted data to crypto_core_ed25519_is_valid_point,\nmishandles checks for whether an elliptic curve point is valid because\nit sometimes allows points that aren't in the main cryptographic group.\n(CVE-2025-69277)\n","status":"published","published":"2026-01-10T05:07:52Z","modified":"2026-04-16T04:43:30.18253476Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10130-1","title":"python311-PyNaCl-1.6.2-1.1 on GA media","description":"These are all security issues fixed in the python311-PyNaCl-1.6.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-02-02T00:00:00Z","modified":"2026-03-23T04:54:29.655675Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20642-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2025-15444: Cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n- CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to\n  crypto_core_ed25519_is_valid_point function (bsc#1255764).\n\nOther fixes:\n\n- Update to 1.0.21\n * The new crypto_ipcrypt_* functions implement mechanisms for securely\n encrypting and anonymizing IP addresses.\n * The sodium_bin2ip and sodium_ip2bin helper functions have been added to\n complement the crypto_ipcrypt_* functions and easily convert addresses\n between bytes and strings.\n * XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are\n * standard\n extendable output functions. From input of any length, they can derive\n output of any length with the same properties as hash functions. These\n primitives are required by many post-quantum mechanisms, but can also be\n used for a wide range of applications, including key derivation, session\n encryption and more.\n * Performance of AES256-GCM and AEGIS on ARM has been improved with some\n compilers\n * Security: optblockers have been introduced in critical code paths to prevent\n compilers from introducing unwanted side channels via conditional jumps. This\n was observed on RISC-V targets with specific compilers and options.\n * Security: crypto_core_ed25519_is_valid_point() now properly rejects\n small-order points that are not in the main subgroup\n * ((nonnull)) attributes have been relaxed on some crypto_stream* functions to\n allow NULL output buffers when the output length is zero\n * A cross-compilation issue with old clang versions has been fixed\n * crypto_aead_aes256gcm_is_available is exported to JavaScript\n * Security: memory fences have been added after MAC verification in AEAD to\n prevent speculative access to plaintext before authentication is complete\n * Assembly files now include .gnu.property notes for proper IBT and Shadow\n Stack support when building with CET instrumentation.\n","status":"published","published":"2026-04-28T15:27:57Z","modified":"2026-05-01T18:27:06.190126Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20650-1","title":"Security update for python-PyNaCl","description":"This update for python-PyNaCl fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to\n  crypto_core_ed25519_is_valid_point function (bsc#1255764).\n\nOther fixes:\n\n- update to 1.6.2 (bsc#1255764, CVE-2025-69277):\n * Updated libsodium to 1.0.20-stable (2025-12-31 build)\n- Update to 1.6.1\n * The ``MAKE`` environment variable can now be used to specify\n the ``make`` binary that should be used in the build process.\n- update to 1.6.0:\n * BACKWARDS INCOMPATIBLE: Removed support for Python 3.6 and\n 3.7.\n * Added support for the low level AEAD AES bindings.\n * Added support for crypto_core_ed25519_from_uniform.\n * Update libsodium to 1.0.20-stable (2025-08-27 build).\n * Added support for free-threaded Python 3.14.\n * Added support for Windows on ARM wheels.\n- Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)\n- python-PyNaCl requires python-cffi [bsc#1161557]\n","status":"published","published":"2026-04-29T14:17:40Z","modified":"2026-05-01T18:26:43.355365Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0368-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues: \n\n- CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n- CVE-2025-69277: Fixed incorrect validation of elliptic curve points in crypto_core_ed25519_is_valid_point function (bsc#1255764).\n","status":"published","published":"2026-02-03T13:40:57Z","modified":"2026-03-23T04:52:10.70043Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0482-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues: \n\n- CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n- CVE-2025-69277: Fixed incorrect validation of elliptic curve points in crypto_core_ed25519_is_valid_point function (bsc#1255764).\n","status":"published","published":"2026-02-12T16:04:29Z","modified":"2026-02-13T16:58:53.105925Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:20448-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\n- CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n- CVE-2025-69277: Fixed incorrect validation of elliptic curve points in crypto_core_ed25519_is_valid_point function (bsc#1255764).\n","status":"published","published":"2026-02-17T08:34:12Z","modified":"2026-03-23T04:52:56.393184Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20484-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\n- CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n- CVE-2025-69277: Fixed incorrect validation of elliptic curve points in crypto_core_ed25519_is_valid_point function (bsc#1255764).\n","status":"published","published":"2026-02-17T09:37:03Z","modified":"2026-03-23T04:52:59.516114Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21393-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2025-15444: Cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n- CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to\n  crypto_core_ed25519_is_valid_point function (bsc#1255764).\n\nOther fixes:\n\n- Update to 1.0.21\n * The new crypto_ipcrypt_* functions implement mechanisms for securely\n encrypting and anonymizing IP addresses.\n * The sodium_bin2ip and sodium_ip2bin helper functions have been added to\n complement the crypto_ipcrypt_* functions and easily convert addresses\n between bytes and strings.\n * XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are\n * standard\n extendable output functions. From input of any length, they can derive\n output of any length with the same properties as hash functions. These\n primitives are required by many post-quantum mechanisms, but can also be\n used for a wide range of applications, including key derivation, session\n encryption and more.\n * Performance of AES256-GCM and AEGIS on ARM has been improved with some\n compilers\n * Security: optblockers have been introduced in critical code paths to prevent\n compilers from introducing unwanted side channels via conditional jumps. This\n was observed on RISC-V targets with specific compilers and options.\n * Security: crypto_core_ed25519_is_valid_point() now properly rejects\n small-order points that are not in the main subgroup\n * ((nonnull)) attributes have been relaxed on some crypto_stream* functions to\n allow NULL output buffers when the output length is zero\n * A cross-compilation issue with old clang versions has been fixed\n * crypto_aead_aes256gcm_is_available is exported to JavaScript\n * Security: memory fences have been added after MAC verification in AEAD to\n prevent speculative access to plaintext before authentication is complete\n * Assembly files now include .gnu.property notes for proper IBT and Shadow\n Stack support when building with CET instrumentation.\n","status":"published","published":"2026-04-28T15:28:13Z","modified":"2026-05-01T18:27:08.864469Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21422-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2025-15444: Cryptographic bypass via improper elliptic curve point validation (bsc#1256070).\n- CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to\n  crypto_core_ed25519_is_valid_point function (bsc#1255764).\n\nOther fixes:\n\n- Update to 1.0.21\n * The new crypto_ipcrypt_* functions implement mechanisms for securely\n encrypting and anonymizing IP addresses.\n * The sodium_bin2ip and sodium_ip2bin helper functions have been added to\n complement the crypto_ipcrypt_* functions and easily convert addresses\n between bytes and strings.\n * XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are\n * standard\n extendable output functions. From input of any length, they can derive\n output of any length with the same properties as hash functions. These\n primitives are required by many post-quantum mechanisms, but can also be\n used for a wide range of applications, including key derivation, session\n encryption and more.\n * Performance of AES256-GCM and AEGIS on ARM has been improved with some\n compilers\n * Security: optblockers have been introduced in critical code paths to prevent\n compilers from introducing unwanted side channels via conditional jumps. This\n was observed on RISC-V targets with specific compilers and options.\n * Security: crypto_core_ed25519_is_valid_point() now properly rejects\n small-order points that are not in the main subgroup\n * ((nonnull)) attributes have been relaxed on some crypto_stream* functions to\n allow NULL output buffers when the output length is zero\n * A cross-compilation issue with old clang versions has been fixed\n * crypto_aead_aes256gcm_is_available is exported to JavaScript\n * Security: memory fences have been added after MAC verification in AEAD to\n prevent speculative access to plaintext before authentication is complete\n * Assembly files now include .gnu.property notes for proper IBT and Shadow\n Stack support when building with CET instrumentation.\n","status":"published","published":"2026-04-28T15:28:13Z","modified":"2026-05-05T18:23:47.096888Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21431-1","title":"Security update for python-PyNaCl","description":"This update for python-PyNaCl fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2025-69277: incorrect validation of elliptic curve points certain custom cryptography or untrusted data to\n  crypto_core_ed25519_is_valid_point function (bsc#1255764).\n\nOther fixes:\n\n- update to 1.6.2 (bsc#1255764, CVE-2025-69277):\n * Updated libsodium to 1.0.20-stable (2025-12-31 build)\n- Update to 1.6.1\n * The ``MAKE`` environment variable can now be used to specify\n the ``make`` binary that should be used in the build process.\n- update to 1.6.0:\n * BACKWARDS INCOMPATIBLE: Removed support for Python 3.6 and\n 3.7.\n * Added support for the low level AEAD AES bindings.\n * Added support for crypto_core_ed25519_from_uniform.\n * Update libsodium to 1.0.20-stable (2025-08-27 build).\n * Added support for free-threaded Python 3.14.\n * Added support for Windows on ARM wheels.\n- Update in SLE-15 (bsc#1199282, jsc#PM-3243, jsc#SLE-24629)\n- python-PyNaCl requires python-cffi [bsc#1161557]\n","status":"published","published":"2026-04-29T14:15:39Z","modified":"2026-05-05T18:23:50.003012Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:4368-1","title":"Security update for libsodium","description":"This update for libsodium fixes the following issues:\n\nUpdate to 1.0.22 (jsc#PED-16890):\n\n  * Post-quantum key encapsulation is now available. ML-KEM768, the\n    NIST-standardized lattice-based KEM, is accessible through the\n    crypto_kem_mlkem768_*() functions.\n  * X-Wing, a hybrid KEM combining ML-KEM768 with X25519 for protection\n    against both classical and quantum adversaries, is available through the\n    crypto_kem_*() functions. X-Wing is the recommended KEM for most\n    applications.\n  * SHA-3 hash functions are now available as crypto_hash_sha3256_*()\n    and crypto_hash_sha3512_*(), with both one-shot and streaming APIs.\n  * Performance: NEON optimizations for Argon2 on ARM platforms.\n  * Performance: SHA3 (Keccak1600) now leverages ARM SHA3 instructions when\n    available on ARM platforms.\n  * Performance: WebAssembly SIMD implementations of Argon2 have been added.\n  * XOF state alignment has been relaxed.\n  * crypto_core_keccak1600_state has been added.\n  * Export missing crypto_ipcrypt_nd_keygen() helper function.\n  * crypto_auth_hmacsha256_init and crypto_auth_hmacsha512_init now\n    accept NULL key pointers (with a zero key length), for consistency with\n    other _init functions.\n  * Fixed compilation with GCC on aarch64 and gcc 4.x.\n  * On aarch64, aes256-gcm is now enabled even when not using clang,\n    including MSVC.\n  * Libsodium can be directly used as a dependency in a Zig project.\n\nUpdate to 1.0.21 (bsc#1256070, CVE-2025-15444, bsc#1255764, CVE-2025-69277):\n\n  * The new crypto_ipcrypt_* functions implement mechanisms for securely\n    encrypting and anonymizing IP addresses.\n  * The sodium_bin2ip and sodium_ip2bin helper functions have been added to\n    complement the crypto_ipcrypt_* functions and easily convert addresses\n    between bytes and strings.\n  * XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are\n  * standard\n    extendable output functions. From input of any length, they can derive\n    output of any length with the same properties as hash functions. These\n    primitives are required by many post-quantum mechanisms, but can also be\n    used for a wide range of applications, including key derivation, session\n    encryption and more.\n  * Performance of AES256-GCM and AEGIS on ARM has been improved with some\n    compilers\n  * Security: optblockers have been introduced in critical code paths to prevent\n    compilers from introducing unwanted side channels via conditional jumps. This\n    was observed on RISC-V targets with specific compilers and options.\n  * Security: crypto_core_ed25519_is_valid_point() now properly rejects\n    small-order points that are not in the main subgroup\n  * ((nonnull)) attributes have been relaxed on some crypto_stream* functions to\n    allow NULL output buffers when the output length is zero\n  * A cross-compilation issue with old clang versions has been fixed\n  * crypto_aead_aes256gcm_is_available is exported to JavaScript\n  * Security: memory fences have been added after MAC verification in AEAD to\n    prevent speculative access to plaintext before authentication is complete\n  * Assembly files now include .gnu.property notes for proper IBT and Shadow\n    Stack support when building with CET instrumentation.\n\nUpdate to 1.0.20:\n\n  * build system updates and portability fixes\n\nIncludes changes from 1.0.19:\n\n  * New AEADs: AEGIS-128L and AEGIS-256\n  * The HKDF key derivation mechanism, required by many standard\n\n    protocols\n  - A test designed to trigger an OOM condition didn't work on\n    Linux systems with memory overcommit turned on. It has been\n  - Emscripten: UTF8ToString() is now exported since\n  - New target: WebAssembly/WASI\n  - New functions to map a hash to an edwards25519 point\n    or get a random point:\n  - crypto_core_ed25519_scalar_mul() has been implemented for\n  - Support for the Ristretto group has been implemented for\n  - Bug fix: sodium_pad() didn't properly support block sizes\n  - JS/WebAssembly: some old iOS versions can't instantiate the\n    crypto_pwhash_scryptsalsa208sha256_str_needs_rehash()didn't\n    returnEINVAL` on input strings with a short length, unlike\n  - Added a workaround for Visual Studio 2010 bug causing CPU\n  - New low-level APIs for arithmetic mod the order of the prime\n  - crypto_core_ed25519_scalar_random(),\n  - crypto_core_ed25519_scalar_invert(),\n  - crypto_core_ed25519_scalar_complement(),\n    crypto_core_ed25519_scalar_add() and\n    crypto_scalarmult_ed25519_base_noclamp() and\n    crypto_scalarmult_ed25519_noclamp().\n\n  * AVX2 detection is more reliable.\n\n    Intel platforms. crypto_generichash() is now faster than MD5 and\n  * In addition to sodium_bin2hex(), sodium_hex2bin() is now a\n  * crypto_generichash_statebytes(), crypto_auth_*_statebytes()\n    and crypto_hash_*_statebytes() have been added in order to\n    retrieve the size of structures keeping states from foreign\n  * The JavaScript target doesn't require /dev/urandom or an\n    external randombytes() implementation any more. Other minor\n    Emscripten-related improvements have been made in order to\n  * Custom randombytes implementations do not need to provide\n    their own implementation of randombytes_uniform() any more.\n    randombytes_stir() and randombytes_close() can also be NULL\n  * On Linux, getrandom(2) is being used instead of directly\n    accessing /dev/urandom, if the kernel supports this system\n\nAlso libsodium users were rebuilt: zeromq, dnsdist, unbound, php7, and usbguard.\n","status":"published","published":"2026-09-28T15:06:19Z","modified":"2026-09-29T09:15:10.902986228Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-7949-1","title":"libsodium vulnerability","description":"It was discovered that Sodium incorrectly handled the elliptic curve point\nvalidity check in certain atypical use cases. This could result in invalid\npoints being used, contrary to expectations.","status":"published","published":"2026-01-08T15:15:58Z","modified":"2026-04-27T18:32:18.49095Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}