Skip to content
Fencer Intel
critical 9.8

CVE-2025-15444 json

Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium

published 10mo ago modified last mo. also EUVD-2026-0979

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium

libsodium <= 1.0.20 or a version of libsodium released before December 30, 2025 contains a vulnerability documented as CVE-2025-69277  https://www.cve.org/CVERecord?id=CVE-2025-69277 .

The libsodium vulnerability states:

In atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

0.000042 includes a version of libsodium updated to 1.0.20-stable, released January 3, 2026, which includes a fix for the vulnerability.

Patch / fix

  • IAMB Crypt::Sodium::XS 0.000042
  • libsodium SLE Module for Basesystem 15 SP7, SLE Micro 5.5, SLE Micro 5.4 +11 more 1.0.22-150000.4.17.1
  • php7 SLE Module for Package Hub 15 SP7, SLE Module for Legacy 15 SP7, SLE High Performance Computing 15 SP4-ESPOS +7 more 7.4.33-150400.4.75.2
  • zeromq SLE Module for Basesystem 15 SP7, SLE Micro 5.5, SLE Micro 5.4 +11 more 4.2.3-150000.3.17.1
  • dnsdist SLE Module for Basesystem 15 SP7 1.9.12-150700.3.11.2
  • dnsdist SLE High Performance Computing 15 SP5-ESPOS, SLE High Performance Computing 15 SP4-ESPOS, SLES for SAP 15 SP6 +7 more 1.8.0-150400.9.8.1
  • unbound SLE Module for Package Hub 15 SP7, SLE Module for Basesystem 15 SP7, SLES for SAP 15 SP6 +1 more 1.25.2-150600.23.21.4
  • php7-fpm SLE Module for Package Hub 15 SP7, SLE High Performance Computing 15 SP4-ESPOS, SLES for SAP 15 SP6 +6 more 7.4.33-150400.4.75.1
  • usbguard SLE Module for Basesystem 15 SP7, SLE High Performance Computing 15 SP5-ESPOS, SLES for SAP 15 SP6 +4 more 1.1.2-150500.6.2.2

suse advisories SUSE-SU-2026:4368-1SUSE-SU-2026:20756-1SUSE-SU-2026:20913-1SUSE-SU-2026:20484-1SUSE-SU-2026:20448-1SUSE-SU-2026:0482-1

  • libsodium openSUSE Leap 16.0 1.0.20-160000.3.1
  • libsodium openSUSE Tumbleweed 1.0.21-1.1

opensuse advisories openSUSE-SU-2026:20399-1openSUSE-SU-2026:10022-1

  • libsodium Azure Linux 3.0 1.0.19-2
  • libsodium CBL-Mariner 2.0 1.0.18-7

azure linux advisories AZL-73751AZL-73755

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2025-15444 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-15444 updated cvss 6.8

libsodium: libsodium: Cryptographic bypass via improper elliptic curve point validation

  • Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images libsodium
    affected: workaround, no fix available
  • Red Hat OpenStack Platform 16.2 libsodium Red Hat OpenStack Platform 17.1 libsodium Red Hat OpenStack Platform 18.0 libsodium Red Hat Satellite 6 libsodium
    affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
10mo ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • IAMB Crypt::Sodium::XS

Classification

Weakness
  • CWE-1395 Dependency on Vulnerable Third-Party Component
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.