CVE-2025-69277: Libsodium

Medium severity, CVSS 4.5. EPSS: 0.2% chance of exploitation in the next 30 days.

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

Affected products

• Libsodium Libsodium

Published 2025-12-31. Last modified 2026-06-17.