CVE-2025-15444VulnerabilityPublished 6 Jan 2026

CVE-2025-15444: IAMB Crypt::Sodium::XS · Dependency on Vulnerable Third-Party Component

Affects IAMB Crypt::Sodium::XSSource CVE Database V5

Mentioned vulnerabilities

CVE-2025-69277

Not known to be exploited · CVSS 9.8 Critical : upgrade to 0.000042 as a priority.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

9.8Critical

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 19% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 0.000042

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade IAMB Crypt::Sodium::XS to 0.000042.

Affected software

Product	Affected	Fixed in
IAMBCrypt::Sodium::XS	Affected <0.000042	Fixed in 0.000042

AI-suggested

To mitigate this vulnerability, European organizations should: 1) Immediately upgrade Crypt::Sodium::XS to version 0.000042 or later, which includes the patched libsodium 1.0.20-stable version. 2) Conduct a thorough inventory of all Perl applications and dependencies to identify usage of vulnerable Crypt::Sodium::XS versions or direct libsodium dependencies. 3) Audit custom cryptographic implementations that rely on libsodium to ensure they do not use the affected crypto_core_ed25519_is_valid_point function in an unsafe manner. 4) Implement strict input validation and sanitization for any untrusted data fed into cryptographic functions. 5) Monitor security advisories for any emerging exploits or patches related to this vulnerability. 6) Employ runtime application self-protection (RASP) or intrusion detection systems to detect anomalous cryptographic operations. 7) Engage with software vendors and open-source communities to ensure timely updates and patches. 8) Consider cryptographic agility strategies to allow rapid replacement of vulnerable components in the future.

Description

CVE-2025-15444 is a critical vulnerability in the Crypt::Sodium::XS Perl module, which depends on a vulnerable version of libsodium (<= 1.0.20). The underlying libsodium flaw (CVE-2025-69277) mishandles validation of elliptic curve points in certain cryptographic operations, potentially allowing invalid points that compromise cryptographic guarantees. This can lead to severe impacts on confidentiality, integrity, and availability without requiring authentication or user interaction. The vulnerability affects all versions of Crypt::Sodium::XS prior to 0.000042, which updates libsodium to a fixed version released January 3, 2026. European organizations relying on this module for cryptographic functions in Perl applications are at risk, especially in sectors handling sensitive data or critical infrastructure. Mitigation requires immediate upgrading to Crypt::Sodium::XS version 0.000042 or later and auditing dependent applications for use of vulnerable libsodium versions.

Impact

For European organizations, the impact of CVE-2025-15444 can be substantial, especially for those using Perl-based applications that depend on Crypt::Sodium::XS for cryptographic functions. The vulnerability compromises the integrity of elliptic curve cryptographic operations, potentially allowing attackers to forge signatures, decrypt sensitive data, or disrupt secure communications. This can lead to data breaches, loss of trust, regulatory non-compliance (e.g., GDPR violations), and operational disruptions. Sectors such as finance, healthcare, government, and critical infrastructure, which often rely on strong cryptography, are particularly at risk. The ease of exploitation without authentication or user interaction increases the threat level, enabling remote attackers to compromise systems silently. Additionally, the dependency on a third-party library means that many applications may be unknowingly vulnerable, complicating detection and remediation efforts. The widespread use of libsodium in cryptographic implementations further amplifies the potential scope of impact across European organizations.

Summary

CVE-2025-15444 identifies a critical security vulnerability in the Crypt::Sodium::XS Perl module, which incorporates a vulnerable version of the libsodium cryptographic library (versions up to 1.0.20). The root cause lies in libsodium's function crypto_core_ed25519_is_valid_point, which is responsible for verifying whether an elliptic curve point belongs to the main cryptographic group. Due to improper validation logic, certain atypical use cases involving custom cryptography or untrusted input can cause the function to accept invalid points. This flaw undermines the fundamental assumptions of elliptic curve cryptography, potentially allowing attackers to bypass cryptographic protections, leading to unauthorized data disclosure, data tampering, or denial of service. The vulnerability does not require any privileges or user interaction to exploit, making it highly accessible to remote attackers. Crypt::Sodium::XS versions prior to 0.000042 embed libsodium versions released before December 30, 2025, which contain this vulnerability. The fixed libsodium version 1.0.20-stable was released on January 3, 2026, and Crypt::Sodium::XS 0.000042 includes this patched version. The vulnerability is tracked under CWE-1395, indicating dependency on a vulnerable third-party component. Although no known exploits are reported in the wild yet, the critical CVSS score (9.8) reflects the severe risk posed by this flaw to confidentiality, integrity, and availability of systems relying on this module for cryptographic operations.

CWE-1395Dependency on Vulnerable Third-Party Component (opens in a new tab)
Class weaknessOWASP Top 10 A03:2025: Software Supply Chain Failures (opens in a new tab)
The product has a dependency on a third-party component that contains one or more known vulnerabilities.
Requirements · Policy
In some industries such as healthcare or technologies such as the cloud, it might be unclear about who is responsible for applying patches for third-party vulnerabilities: the vendor, the operator/customer, or a separate service.
Requirements
Require a Bill of Materials for all components and sub-components of the product. For software, require a Software Bill of Materials (SBOM).
Architecture and Design · Implementation · Integration · Manufacturing
Maintain a Bill of Materials for all components and sub-components of the product. For software, maintain a Software Bill of Materials (SBOM). According to, "An SBOM is a formal, machine-readable inventory of software components and dependencies, information about those components, and their hierarchical…
OWASP Cheat Sheets
OWASP Cheat Sheet Series: Dependency Graph SBOM (opens in a new tab)
OWASP Cheat Sheet Series: Vulnerable Dependency Management (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Jan 2026, 01:00 UTC

WeaknessesCWE-1395

Technical details

References

Community reviews

Related threats