Cryptographic issues in libsodium - CVE-2025-69277

Vulnerability identifier: #VU120975

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2025-69277

CWE-ID: CWE-310

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to read or manipulate encrypted data.

The vulnerability exists due to an error within the ge25519_is_on_main_subgroup() function in src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c  in atypical use cases involving certain custom cryptography or untrusted data passed to crypto_core_ed25519_is_valid_point(). A remote attacker can read or manipulate encrypted data.

libsodium
Storage Defender - Resiliency Service
Maximo Application Suite - Edge Data Collector
QRadar App SDK
Debian Linux
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Micro
Public Cloud Module
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Package Hub 15
Legacy Module
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
Anolis OS
Nautobot
PowerVC
libsodium23
libsodium (Ubuntu package)
libsodium (Debian package)
libsodium-devel
libsodium-debugsource
libsodium-debuginfo
libsodium
libsodium-doc
libsodium-static
libsodium23-debuginfo
libsodium23-32bit
libsodium23-32bit-debuginfo
libsodium26
libsodium26-debuginfo
libsodium26-32bit-debuginfo
libsodium26-32bit
usbguard-tools
usbguard-devel
usbguard-debugsource
usbguard
libusbguard1
usbguard-tools-debuginfo
libusbguard1-debuginfo
usbguard-debuginfo
dnsdist-debuginfo
dnsdist
dnsdist-debugsource
unbound-devel
unbound-python-debuginfo
libunbound-devel-mini-debugsource
unbound-python
libunbound-devel-mini-debuginfo
unbound
unbound-munin
libunbound-devel-mini
libunbound8
unbound-anchor
unbound-anchor-debuginfo
libunbound8-debuginfo
unbound-debuginfo
unbound-debugsource
zeromq-devel
zeromq-debugsource
libzmq5
libzmq5-debuginfo
apache2-mod_php7-debuginfo
php7-fastcgi-debuginfo
php7-fpm
php7-fpm-debugsource
php7-fastcgi-debugsource
php7-fpm-debuginfo
php7-embed
php7-embed-debuginfo
php7-fastcgi
php7-embed-debugsource
apache2-mod_php7
php7-test
apache2-mod_php7-debugsource
php7-ctype
php7-ftp
php7-calendar
php7-sysvsem-debuginfo
php7-tokenizer
php7-posix-debuginfo
php7-enchant-debuginfo
php7-gd
php7-xsl-debuginfo
php7-intl-debuginfo
php7-mysql-debuginfo
php7-readline
php7-sysvshm-debuginfo
php7-xmlreader-debuginfo
php7-snmp
php7-dba-debuginfo
php7-dom
php7-curl-debuginfo
php7-sockets-debuginfo
php7-xmlwriter
php7-exif
php7-tidy-debuginfo
php7-zlib
php7-debugsource
php7-pgsql-debuginfo
php7-pdo
php7-bcmath
php7-sockets
php7-odbc-debuginfo
php7-phar-debuginfo
php7-mysql
php7-sodium-debuginfo
php7-opcache
php7-zip
php7-xmlrpc-debuginfo
php7-exif-debuginfo
php7-mbstring
php7-ctype-debuginfo
php7-gmp
php7-bcmath-debuginfo
php7-pdo-debuginfo
php7-sysvsem
php7-mbstring-debuginfo
php7
php7-shmop
php7-xmlreader
php7-sodium
php7-shmop-debuginfo
php7-xmlwriter-debuginfo
php7-cli
php7-tokenizer-debuginfo
php7-pcntl
php7-dom-debuginfo
php7-tidy
php7-soap-debuginfo
php7-dba
php7-bz2
php7-soap
php7-sysvmsg-debuginfo
php7-xsl
php7-fileinfo
php7-ldap
php7-gmp-debuginfo
php7-sqlite
php7-enchant
php7-openssl
php7-zip-debuginfo
php7-sqlite-debuginfo
php7-curl
php7-readline-debuginfo
php7-snmp-debuginfo
php7-zlib-debuginfo
php7-fileinfo-debuginfo
php7-iconv
php7-ftp-debuginfo
php7-cli-debuginfo
php7-calendar-debuginfo
php7-devel
php7-json-debuginfo
php7-xmlrpc
php7-phar
php7-bz2-debuginfo
php7-pcntl-debuginfo
php7-opcache-debuginfo
php7-pgsql
php7-gd-debuginfo
php7-sysvmsg
php7-iconv-debuginfo
php7-debuginfo
php7-intl
php7-posix
php7-gettext-debuginfo
php7-gettext
php7-odbc
php7-sysvshm
php7-json
php7-ldap-debuginfo
php7-openssl-debuginfo

Install updates from vendor's website.

Nautobot - addressed in versions 2.4.25, 3.0.4
Storage Defender - Resiliency Service - update to 2.1.3
Maximo Application Suite - Edge Data Collector - addressed in versions 8.11.27, 9.0.19, 9.1.9
libsodium23 - addressed in versions 1.0.16-1.15.1, 1.0.18-150000.4.14.1
libsodium (Ubuntu package) - addressed in versions 1.0.18-1ubuntu0.22.04.1, 1.0.18-1ubuntu0.24.04.1, 1.0.18-1ubuntu0.25.04.1, 1.0.18-1ubuntu0.25.10.1
libsodium (Debian package) - addressed in versions 1.0.18-1+deb12u1, 1.0.18-1+deb13u1
libsodium-devel - addressed in versions 1.0.18-2, 1.0.19-2
libsodium-debugsource - addressed in versions 1.0.18-2, 1.0.19-2
libsodium-debuginfo - addressed in versions 1.0.18-2, 1.0.19-2
libsodium - addressed in versions 1.0.18-2, 1.0.19-2
libsodium-doc - addressed in versions 1.0.18-2, 1.0.18-3
libsodium-static - addressed in versions 1.0.18-2, 1.0.18-3
libsodium-devel - addressed in versions 1.0.18-2, 1.0.18-3
libsodium - addressed in versions 1.0.18-2, 1.0.18-3
libsodium-debugsource - addressed in versions 1.0.18-150000.4.14.1, 1.0.21-160000.1.1, 1.0.22-150000.4.17.1
libsodium23-debuginfo - update to 1.0.18-150000.4.14.1
libsodium-devel - addressed in versions 1.0.18-150000.4.14.1, 1.0.22-150000.4.17.1
libsodium23-32bit - update to 1.0.18-150000.4.14.1
libsodium23-32bit-debuginfo - update to 1.0.18-150000.4.14.1
libsodium26 - addressed in versions 1.0.21-160000.1.1, 1.0.22-150000.4.17.1
libsodium26-debuginfo - addressed in versions 1.0.21-160000.1.1, 1.0.22-150000.4.17.1
libsodium26-32bit-debuginfo - update to 1.0.22-150000.4.17.1
libsodium26-32bit - update to 1.0.22-150000.4.17.1
usbguard-tools - addressed in versions 1.1.2-150400.3.5.1, 1.1.2-150500.6.2.2
usbguard-devel - addressed in versions 1.1.2-150400.3.5.1, 1.1.2-150500.6.2.2
usbguard-debugsource - addressed in versions 1.1.2-150400.3.5.1, 1.1.2-150500.6.2.2
usbguard - addressed in versions 1.1.2-150400.3.5.1, 1.1.2-150500.6.2.2
libusbguard1 - addressed in versions 1.1.2-150400.3.5.1, 1.1.2-150500.6.2.2
usbguard-tools-debuginfo - addressed in versions 1.1.2-150400.3.5.1, 1.1.2-150500.6.2.2
libusbguard1-debuginfo - addressed in versions 1.1.2-150400.3.5.1, 1.1.2-150500.6.2.2
usbguard-debuginfo - addressed in versions 1.1.2-150400.3.5.1, 1.1.2-150500.6.2.2
dnsdist-debuginfo - addressed in versions 1.8.0-150400.9.8.1, 1.9.12-150700.3.11.2
dnsdist - addressed in versions 1.8.0-150400.9.8.1, 1.9.12-150700.3.11.2
dnsdist-debugsource - addressed in versions 1.8.0-150400.9.8.1, 1.9.12-150700.3.11.2
unbound-devel - update to 1.25.2-150600.23.21.4
unbound-python-debuginfo - update to 1.25.2-150600.23.21.4
libunbound-devel-mini-debugsource - update to 1.25.2-150600.23.21.4
unbound-python - update to 1.25.2-150600.23.21.4
libunbound-devel-mini-debuginfo - update to 1.25.2-150600.23.21.4
unbound - update to 1.25.2-150600.23.21.4
unbound-munin - update to 1.25.2-150600.23.21.4
libunbound-devel-mini - update to 1.25.2-150600.23.21.4
libunbound8 - update to 1.25.2-150600.23.21.4
unbound-anchor - update to 1.25.2-150600.23.21.4
unbound-anchor-debuginfo - update to 1.25.2-150600.23.21.4
libunbound8-debuginfo - update to 1.25.2-150600.23.21.4
unbound-debuginfo - update to 1.25.2-150600.23.21.4
unbound-debugsource - update to 1.25.2-150600.23.21.4
QRadar App SDK - update to 2.2.5
zeromq-devel - update to 4.2.3-150000.3.17.1
zeromq-debugsource - update to 4.2.3-150000.3.17.1
libzmq5 - update to 4.2.3-150000.3.17.1
libzmq5-debuginfo - update to 4.2.3-150000.3.17.1
apache2-mod_php7-debuginfo - update to 7.4.33-150400.4.75.1
php7-fastcgi-debuginfo - update to 7.4.33-150400.4.75.1
php7-fpm - update to 7.4.33-150400.4.75.1
php7-fpm-debugsource - update to 7.4.33-150400.4.75.1
php7-fastcgi-debugsource - update to 7.4.33-150400.4.75.1
php7-fpm-debuginfo - update to 7.4.33-150400.4.75.1
php7-embed - update to 7.4.33-150400.4.75.1
php7-embed-debuginfo - update to 7.4.33-150400.4.75.1
php7-fastcgi - update to 7.4.33-150400.4.75.1
php7-embed-debugsource - update to 7.4.33-150400.4.75.1
apache2-mod_php7 - update to 7.4.33-150400.4.75.1
php7-test - update to 7.4.33-150400.4.75.1
apache2-mod_php7-debugsource - update to 7.4.33-150400.4.75.1
php7-ctype - update to 7.4.33-150400.4.75.2
php7-ftp - update to 7.4.33-150400.4.75.2
php7-calendar - update to 7.4.33-150400.4.75.2
php7-sysvsem-debuginfo - update to 7.4.33-150400.4.75.2
php7-tokenizer - update to 7.4.33-150400.4.75.2
php7-posix-debuginfo - update to 7.4.33-150400.4.75.2
php7-enchant-debuginfo - update to 7.4.33-150400.4.75.2
php7-gd - update to 7.4.33-150400.4.75.2
php7-xsl-debuginfo - update to 7.4.33-150400.4.75.2
php7-intl-debuginfo - update to 7.4.33-150400.4.75.2
php7-mysql-debuginfo - update to 7.4.33-150400.4.75.2
php7-readline - update to 7.4.33-150400.4.75.2
php7-sysvshm-debuginfo - update to 7.4.33-150400.4.75.2
php7-xmlreader-debuginfo - update to 7.4.33-150400.4.75.2
php7-snmp - update to 7.4.33-150400.4.75.2
php7-dba-debuginfo - update to 7.4.33-150400.4.75.2
php7-dom - update to 7.4.33-150400.4.75.2
php7-curl-debuginfo - update to 7.4.33-150400.4.75.2
php7-sockets-debuginfo - update to 7.4.33-150400.4.75.2
php7-xmlwriter - update to 7.4.33-150400.4.75.2
php7-exif - update to 7.4.33-150400.4.75.2
php7-tidy-debuginfo - update to 7.4.33-150400.4.75.2
php7-zlib - update to 7.4.33-150400.4.75.2
php7-debugsource - update to 7.4.33-150400.4.75.2
php7-pgsql-debuginfo - update to 7.4.33-150400.4.75.2
php7-pdo - update to 7.4.33-150400.4.75.2
php7-bcmath - update to 7.4.33-150400.4.75.2
php7-sockets - update to 7.4.33-150400.4.75.2
php7-odbc-debuginfo - update to 7.4.33-150400.4.75.2
php7-phar-debuginfo - update to 7.4.33-150400.4.75.2
php7-mysql - update to 7.4.33-150400.4.75.2
php7-sodium-debuginfo - update to 7.4.33-150400.4.75.2
php7-opcache - update to 7.4.33-150400.4.75.2
php7-zip - update to 7.4.33-150400.4.75.2
php7-xmlrpc-debuginfo - update to 7.4.33-150400.4.75.2
php7-exif-debuginfo - update to 7.4.33-150400.4.75.2
php7-mbstring - update to 7.4.33-150400.4.75.2
php7-ctype-debuginfo - update to 7.4.33-150400.4.75.2
php7-gmp - update to 7.4.33-150400.4.75.2
php7-bcmath-debuginfo - update to 7.4.33-150400.4.75.2
php7-pdo-debuginfo - update to 7.4.33-150400.4.75.2
php7-sysvsem - update to 7.4.33-150400.4.75.2
php7-mbstring-debuginfo - update to 7.4.33-150400.4.75.2
php7 - update to 7.4.33-150400.4.75.2
php7-shmop - update to 7.4.33-150400.4.75.2
php7-xmlreader - update to 7.4.33-150400.4.75.2
php7-sodium - update to 7.4.33-150400.4.75.2
php7-shmop-debuginfo - update to 7.4.33-150400.4.75.2
php7-xmlwriter-debuginfo - update to 7.4.33-150400.4.75.2
php7-cli - update to 7.4.33-150400.4.75.2
php7-tokenizer-debuginfo - update to 7.4.33-150400.4.75.2
php7-pcntl - update to 7.4.33-150400.4.75.2
php7-dom-debuginfo - update to 7.4.33-150400.4.75.2
php7-tidy - update to 7.4.33-150400.4.75.2
php7-soap-debuginfo - update to 7.4.33-150400.4.75.2
php7-dba - update to 7.4.33-150400.4.75.2
php7-bz2 - update to 7.4.33-150400.4.75.2
php7-soap - update to 7.4.33-150400.4.75.2
php7-sysvmsg-debuginfo - update to 7.4.33-150400.4.75.2
php7-xsl - update to 7.4.33-150400.4.75.2
php7-fileinfo - update to 7.4.33-150400.4.75.2
php7-ldap - update to 7.4.33-150400.4.75.2
php7-gmp-debuginfo - update to 7.4.33-150400.4.75.2
php7-sqlite - update to 7.4.33-150400.4.75.2
php7-enchant - update to 7.4.33-150400.4.75.2
php7-openssl - update to 7.4.33-150400.4.75.2
php7-zip-debuginfo - update to 7.4.33-150400.4.75.2
php7-sqlite-debuginfo - update to 7.4.33-150400.4.75.2
php7-curl - update to 7.4.33-150400.4.75.2
php7-readline-debuginfo - update to 7.4.33-150400.4.75.2
php7-snmp-debuginfo - update to 7.4.33-150400.4.75.2
php7-zlib-debuginfo - update to 7.4.33-150400.4.75.2
php7-fileinfo-debuginfo - update to 7.4.33-150400.4.75.2
php7-iconv - update to 7.4.33-150400.4.75.2
php7-ftp-debuginfo - update to 7.4.33-150400.4.75.2
php7-cli-debuginfo - update to 7.4.33-150400.4.75.2
php7-calendar-debuginfo - update to 7.4.33-150400.4.75.2
php7-devel - update to 7.4.33-150400.4.75.2
php7-json-debuginfo - update to 7.4.33-150400.4.75.2
php7-xmlrpc - update to 7.4.33-150400.4.75.2
php7-phar - update to 7.4.33-150400.4.75.2
php7-bz2-debuginfo - update to 7.4.33-150400.4.75.2
php7-pcntl-debuginfo - update to 7.4.33-150400.4.75.2
php7-opcache-debuginfo - update to 7.4.33-150400.4.75.2
php7-pgsql - update to 7.4.33-150400.4.75.2
php7-gd-debuginfo - update to 7.4.33-150400.4.75.2
php7-sysvmsg - update to 7.4.33-150400.4.75.2
php7-iconv-debuginfo - update to 7.4.33-150400.4.75.2
php7-debuginfo - update to 7.4.33-150400.4.75.2
php7-intl - update to 7.4.33-150400.4.75.2
php7-posix - update to 7.4.33-150400.4.75.2
php7-gettext-debuginfo - update to 7.4.33-150400.4.75.2
php7-gettext - update to 7.4.33-150400.4.75.2
php7-odbc - update to 7.4.33-150400.4.75.2
php7-sysvshm - update to 7.4.33-150400.4.75.2
php7-json - update to 7.4.33-150400.4.75.2
php7-ldap-debuginfo - update to 7.4.33-150400.4.75.2
php7-openssl-debuginfo - update to 7.4.33-150400.4.75.2

• https://00f.net/2025/12/30/libsodium-vulnerability/
• https://github.com/jedisct1/libsodium/commit/ad3004ec8731730e93fcfbbc824e67eadc1c1bae
• https://ianix.com/pub/ed25519-deployment.html
• https://news.ycombinator.com/item?id=46435614

• Cryptographic issues in libsodium
• Debian update for libsodium
• Ubuntu update for libsodium
• Nautobot update for third-party dependencies
• openEuler 24.03 LTS SP1 update for libsodium
• openEuler 24.03 LTS update for libsodium
• openEuler 24.03 LTS SP3 update for libsodium
• openEuler 22.03 LTS SP4 update for libsodium
• openEuler 24.03 LTS SP2 update for libsodium
• openEuler 22.03 LTS SP3 update for libsodium
• Anolis OS update for libsodium
• Anolis OS update for libsodium
• SUSE update for libsodium
• SUSE update for libsodium
• openEuler 20.03 LTS SP4 update for libsodium
• IBM Edge Data Collector update for libsodium
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• SUSE update for libsodium
• IBM PowerVC update for libsodium
• Multiple vulnerabilities in IBM QRadar App SDK
• SUSE update for libsodium