{"id":"GHSA-mrfv-m5wm-5w6w","summary":"libsodium has Incomplete List of Disallowed Inputs","details":"libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.\n\nThis advisoory lists packages in the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database?tab=readme-ov-file#supported-ecosystems) that are affected by this vulnerability due to a vulnerable dependency.","aliases":["CVE-2025-69277","PYSEC-2026-1448","PYSEC-2026-3002"],"modified":"2026-07-17T21:14:09.753260646Z","published":"2025-12-31T06:30:18Z","database_specific":{"nvd_published_at":"2025-12-31T06:15:41Z","cwe_ids":["CWE-184"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-01-06T17:12:24Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69277"},{"type":"WEB","url":"https://github.com/pyca/pynacl/issues/920"},{"type":"WEB","url":"https://github.com/hdwallet-io/python-hdwallet/pull/124"},{"type":"WEB","url":"https://github.com/jedisct1/libsodium/commit/ad3004ec8731730e93fcfbbc824e67eadc1c1bae"},{"type":"WEB","url":"https://github.com/paragonie/sodium_compat/commit/2cb48f26130919f92f30650bdcc30e6f4ebe45ac"},{"type":"WEB","url":"https://github.com/paragonie/sodium_compat/commit/4714da6efdc782c06690bc72ce34fae7941c2d9f"},{"type":"WEB","url":"https://github.com/pyca/pynacl/commit/96314884d88d1089ff5f336dba61d7abbcddbbf7"},{"type":"WEB","url":"https://github.com/pyca/pynacl/commit/ecf41f55a3d8f1e10ce89c61c4b4d67f3f4467cf"},{"type":"WEB","url":"https://00f.net/2025/12/30/libsodium-vulnerability"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/paragonie/sodium_compat/2025-12-30.yaml"},{"type":"PACKAGE","url":"https://github.com/paragonie/sodium_compat"},{"type":"WEB","url":"https://ianix.com/pub/ed25519-deployment.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00004.html"},{"type":"WEB","url":"https://news.ycombinator.com/item?id=46435614"}],"affected":[{"package":{"name":"paragonie/sodium_compat","ecosystem":"Packagist","purl":"pkg:composer/paragonie/sodium_compat"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2"},{"fixed":"2.5.0"}]}],"versions":["v2.0.1","v2.1.0","v2.2.0","v2.3.0","v2.3.1","v2.4.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mrfv-m5wm-5w6w/GHSA-mrfv-m5wm-5w6w.json"}},{"package":{"name":"paragonie/sodium_compat","ecosystem":"Packagist","purl":"pkg:composer/paragonie/sodium_compat"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0"}]}],"versions":["v0.1.0","v0.1.1","v0.2.0","v0.2.1","v0.2.2","v0.3.0","v0.3.1","v0.4.0","v0.5.0","v0.6.0","v0.7.0","v0.8.0","v0.8.1","v1.0.0","v1.0.1","v1.1.0","v1.10.0","v1.10.1","v1.11.0","v1.11.1","v1.11.2","v1.11.3","v1.11.4","v1.12.0","v1.12.1","v1.12.2","v1.13.0","v1.14.0","v1.15.0","v1.15.1","v1.15.2","v1.15.3","v1.15.4","v1.16.0","v1.16.1","v1.17.0","v1.17.1","v1.18.0","v1.18.1","v1.19.0","v1.2.0","v1.20.0","v1.20.1","v1.21.0","v1.21.1","v1.21.2","v1.22.0","v1.23.0","v1.3.0","v1.3.1","v1.4.0","v1.5.0","v1.5.1","v1.5.2","v1.5.3","v1.5.4","v1.5.5","v1.5.6","v1.6.0","v1.6.1","v1.6.2","v1.6.3","v1.6.4","v1.6.5","v1.6.6","v1.7.0","v1.8.0","v1.8.1","v1.9.0","v1.9.1","v1.9.2","v1.9.3","v1.9.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mrfv-m5wm-5w6w/GHSA-mrfv-m5wm-5w6w.json"}},{"package":{"name":"pynacl","ecosystem":"PyPI","purl":"pkg:pypi/pynacl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2"}]}],"versions":["0.1.0","0.2.0","0.2.1","0.2.2","0.2.3","0.3.0","1.0","1.0.1","1.1.0","1.1.1","1.1.2","1.2.0","1.2.1","1.3.0","1.4.0","1.5.0","1.6.0","1.6.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mrfv-m5wm-5w6w/GHSA-mrfv-m5wm-5w6w.json"}},{"package":{"name":"hdwallet","ecosystem":"PyPI","purl":"pkg:pypi/hdwallet"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1"}]}],"versions":["0.1.0","0.1.0a1","0.1.1","0.2.0","1.0.0","1.0.1","1.1.0","1.1.1","1.2.0","1.3.0","1.3.1","1.3.2","2.0.0","2.0.0a1","2.0.1","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","3.0.0","3.0.1","3.1.0","3.1.0b1","3.1.0b2","3.2.0","3.2.1","3.2.3","3.3.0","3.4.0","3.5.1","3.6.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-mrfv-m5wm-5w6w/GHSA-mrfv-m5wm-5w6w.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"}]}