GitHub Advisoryadvisory · Packagist, PyPI

GHSA-mrfv-m5wm-5w6w libsodium has Incomplete List of Disallowed Inputs

MEDIUM Published 2025-12-31 Modified 2026-01-07 Official page ↗
Aliases
CVE-2025-69277
Ecosystem
Packagist, PyPI
Packages
paragonie/sodium_compat, PyNaCl, hdwallet
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-184
Reviewed
2026-01-06

Affected packages

• Packagist paragonie/sodium_compat: >= 2, < 2.5.0 → fixed in 2.5.0 • Packagist paragonie/sodium_compat: < 1.24.0 → fixed in 1.24.0 • PyPI PyNaCl: < 1.6.2 → fixed in 1.6.2 • PyPI hdwallet: < 3.6.1 → fixed in 3.6.1

Description

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group. This advisoory lists packages in the GitHub Advisory Database's supported ecosystems that are affected by this vulnerability due to a vulnerable dependency.

Related

Alias · CVE (1)

  • CVE-2025-69277 libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to… vulnerability

Weakness · CWE (1)

  • CWE-184 Incomplete List of Disallowed Inputs weakness

References