libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group.

🗓️ 03 Jan 2026 09:01:58Reported by MicrosoftType

Libsodium before ad3004e mishandled ed25519 point validity for unusual inputs, allowing points outside main group.

Reporter	Title	Published	Views	Family All 137
IBM Security Bulletins	Security Bulletin:libsodium vulnerability: invalid elliptic curve point validation in crypto_core_ed25519_is_valid_point	4 May 202617:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability assertj-core, spring-security-crypto, werkzeug, urllib, libsodium, jersey-client, log4j, dmidecode-dmidecode, and aide affect IBM Cloud Object Storage Systems (FEB 2026)	27 Feb 202617:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses PyNaCl-1.4.0-cp35-abi3-manylinux1_x86_64.whl which is vulnerable to CVE-2025-69277.	30 Mar 202607:03	–	ibm
IBM Security Bulletins	Security Bulletin: Denial of service, security controls bypass, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service	20 Apr 202616:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (February 2026)	27 Feb 202603:34	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar App SDK for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	7 Jul 202617:18	–	ibm
FreeBSD	security/libsodium -- crypto_core_ed25519_is_valid_point mishandles checks for whether an elliptic curve point is valid	30 Dec 202500:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : libsodium, libsodium-devel, libsodium-static (ALAS2023-2026-1493)	30 Mar 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : libsodium, --advisory ALAS2-2026-3206 (ALAS-2026-3206)	19 Mar 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : libsodium, --advisory ALAS2PHP8.2-2026-010 (ALASPHP8.2-2026-010)	19 Mar 202600:00	–	nessus