CVE-2025-69277: 
Python vulnerability analysis and mitigation

CVE-2025-69277 is an elliptic curve point validation bypass vulnerability in libsodium, a widely used cryptographic library. The flaw exists in the crypto_core_ed25519_is_valid_point() function, which in certain atypical use cases incorrectly accepts points that are not in the main Ed25519 cryptographic subgroup. It affects libsodium versions prior to commit ad3004ec8731730e93fcfbbc824e67eadc1c1bae (i.e., before the 1.0.20-stable release of December 31, 2025), including Microsoft Azure Linux packages cbl2_libsodium_1.0.18-6, cbl2_libsodium_1.0.18-7, azl3_libsodium_1.0.19-1, and azl3_libsodium_1.0.19-2. The vulnerability was disclosed on December 31, 2025, and is notable as libsodium's first publicly assigned CVE. It carries a CVSS v3.1 base score of 4.5 (Medium) (ENISA EUVD, Microsoft MSRC).

The root cause is classified as CWE-184 (Incomplete List of Disallowed Inputs). The ge25519_is_on_main_subgroup() function in src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c previously only checked whether the X coordinate of the scalar-multiplied point was zero (fe25519_iszero(pl.X)), but failed to also verify that Y == Z (i.e., that the point is the identity element in projective coordinates). This incomplete check allowed certain small-order points outside the main Ed25519 subgroup — such as the point encoded as 0x9599...99 — to pass validation incorrectly. The fix adds a second condition: fe25519_sub(t, pl.Y, pl.Z) followed by fe25519_iszero(t), requiring both conditions to be true for a point to be considered valid. Exploitation requires an attacker to supply crafted elliptic curve points to an application that passes untrusted data to crypto_core_ed25519_is_valid_point(), which is only relevant in atypical custom cryptography use cases (libsodium commit, ENISA EUVD).

Successful exploitation could allow a local attacker to bypass Ed25519 signature verification or authentication mechanisms in applications that rely on crypto_core_ed25519_is_valid_point() with untrusted input, potentially enabling signature forgery. The CVSS assessment indicates low confidentiality and low integrity impact with no availability impact, and a changed scope — meaning the effect can extend beyond the vulnerable component itself. The vulnerability is limited to atypical use cases involving custom cryptographic protocols or direct use of the low-level Ed25519 point validation API; standard libsodium signature operations (e.g., crypto_sign) are not directly affected (ENISA EUVD, Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.015% (0.000150), reflecting very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity, as it is limited to specific custom cryptographic use cases where untrusted data is passed directly to the affected API (ENISA EUVD, Feedly).

The fix is available in libsodium commit ad3004ec8731730e93fcfbbc824e67eadc1c1bae, included in the 1.0.20-stable release (dated December 31, 2025). Microsoft released patched packages for Azure Linux on January 3, 2026. Downstream distributions including Debian (DSA-6094-1, DLA-4435-1), Fedora, Mageia, SUSE, Slackware, Ubuntu, and Amazon Linux 2 have all issued updated packages. Python users should upgrade PyNaCl to version 1.6.2 or later, which bundles the patched libsodium. IBM has addressed the issue in IBM Observability with Instana (OnPrem) and QRadar Suite Software. Organizations should update libsodium to the patched version and audit any custom cryptographic code that calls crypto_core_ed25519_is_valid_point() with untrusted input (libsodium commit, PyNaCl changelog, IBM Advisory).

The vulnerability was noted as libsodium's first publicly assigned CVE, generating notable community interest. A blog post by the libsodium author (Frank Denis, 00f.net) provided the initial technical disclosure and was widely shared on Hacker News (item #46435614). The PyNaCl project promptly filed a security issue and released version 1.6.2 within days to bundle the patched libsodium. Coverage appeared across Linux security news outlets, pro-linux.de, and cybersecurity roundup blogs, with the CyberHub blog highlighting it as part of the January 2026 cybersecurity roundup (00f.net blog, PyNaCl issue).