IAMB Crypt::Sodium::XS up to 0.41 vulnerable third-party component

Summaryinfo

A vulnerability described as problematic has been identified in IAMB Crypt::Sodium::XS up to 0.41. Affected is an unknown function. The manipulation results in vulnerable third-party component. This vulnerability is cataloged as CVE-2025-15444. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in IAMB Crypt::Sodium::XS up to 0.41. Affected is an unknown code block. The manipulation with an unknown input leads to a vulnerable third-party component vulnerability. CWE is classifying the issue as CWE-1395. The product has a dependency on a third-party component that contains one or more known vulnerabilities. This is going to have an impact on confidentiality. CVE summarizes:

Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium libsodium <= 1.0.20 or a version of libsodium released before December 30, 2025 contains a vulnerability documented as CVE-2025-69277  https://www.cve.org/CVERecord?id=CVE-2025-69277 . The libsodium vulnerability states: In atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the main cryptographic group. 0.000042 includes a version of libsodium updated to 1.0.20-stable, released January 3, 2026, which includes a fix for the vulnerability.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-15444 since 01/03/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 294915 (SUSE SLES12 Security Update : libsodium (SUSE-SU-2026:0194-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.000042 eliminates this vulnerability. Applying the patch ad3004ec8731730e93fcfbbc824e67eadc1c1bae is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (294915). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• IAMB

Name

• Crypt::Sodium::XS

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion