CVE-2025-69277

Katalog CVE

CVSS 4.5 · Medium EPSS 0,18%

Kerentanan Incomplete List of Disallowed Inputs. Skor CVSS 3.1 4.5 (Medium) menurut mitre.org.

Deskripsi (NVD)

libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

Rincian

Terbit di NVD

31 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

4.5 (Medium), sumber mitre.org
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-184: Incomplete List of Disallowed Inputs

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 7,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://00f.net/2025/12/30/libsodium-vulnerability/
• https://github.com/jedisct1/libsodium/commit/ad3004ec8731730e93fcfbbc824e67eadc1c1bae
• https://github.com/pyca/pynacl/commit/96314884d88d1089ff5f336dba61d7abbcddbbf7
• https://github.com/pyca/pynacl/commit/ecf41f55a3d8f1e10ce89c61c4b4d67f3f4467cf
• https://github.com/pyca/pynacl/issues/920
• https://ianix.com/pub/ed25519-deployment.html
• https://news.ycombinator.com/item?id=46435614
• https://lists.debian.org/debian-lts-announce/2026/01/msg00004.html