CVE-2020-25021: Noise-Java Project Noise-Java

Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days.

An issue was discovered in Noise-Java through 2020-08-27. ChaChaPolyCipherState.encryptWithAd() allows out-of-bounds access.

Affected products

• Noise-Java Project Noise-Java: up to and including 2020-08-27

Published 2020-09-04. Last modified 2026-06-17.