SB2026011328 - Nautobot update for third-party dependencies

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Cryptographic issues (CVE-ID: CVE-2025-69277)

The vulnerability allows a remote attacker to read or manipulate encrypted data.

The vulnerability exists due to an error within the ge25519_is_on_main_subgroup() function in src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c  in atypical use cases involving certain custom cryptography or untrusted data passed to crypto_core_ed25519_is_valid_point(). A remote attacker can read or manipulate encrypted data.

2) Improper handling of highly compressed data (CVE-ID: CVE-2026-21441)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the application does not properly handle highly compressed data when sending HTTP redirect responses. A remote attacker can multiple large requests to the application, consume all available CPU and memory resources and perform a denial of service attack.

Remediation

Install update from vendor's website.

References

• https://github.com/nautobot/nautobot/releases/tag/v2.4.25"
• https://github.com/nautobot/nautobot/releases/tag/v2.4.25</a></p><p>
• https://github.com/nautobot/nautobot/releases/tag/v3.0.4</p><p><br></p>