CVE-2025-15444: Crypt::Sodium::XS Cryptographic Vulnerability

CVE-2025-15444 Overview

CVE-2025-15444 is a critical cryptographic vulnerability affecting the Crypt::Sodium::XS Perl module versions prior to 0.000042. The vulnerability stems from the module's inclusion of a vulnerable version of libsodium (versions 1.0.20 and earlier, or versions released before December 30, 2025). This issue relates to the underlying CVE-2025-69277 vulnerability in libsodium, which involves improper validation of elliptic curve points in the Ed25519 cryptographic implementation.

The vulnerability specifically affects the crypto_core_ed25519_is_valid_point function, which fails to properly validate whether an elliptic curve point belongs to the main cryptographic group. This flaw could allow attackers to submit invalid points that pass validation checks, potentially compromising cryptographic operations that rely on Ed25519 curve mathematics.

Critical Impact

This cryptographic validation flaw could allow attackers to bypass point validation checks in Ed25519 operations, potentially compromising signature verification, key exchange protocols, and other cryptographic operations in applications using the affected Crypt::Sodium::XS module.

Affected Products

• Crypt::Sodium::XS module for Perl (versions prior to 0.000042)
• libsodium versions 1.0.20 and earlier
• Applications utilizing Ed25519 cryptographic operations with custom or untrusted input

Discovery Timeline

• 2026-01-06 - CVE-2025-15444 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-15444

Vulnerability Analysis

This vulnerability resides in the elliptic curve point validation logic within libsodium's Ed25519 implementation. The ge25519_is_on_main_subgroup function was performing an incomplete check to determine whether a given point belongs to the main cryptographic subgroup of the Ed25519 curve. The original implementation only verified that the X coordinate was zero after scalar multiplication by the group order (L), which is insufficient to confirm the point is in the correct subgroup.

In atypical use cases involving custom cryptography or when processing untrusted data passed to crypto_core_ed25519_is_valid_point, the incomplete validation could allow points that aren't in the main cryptographic group to pass verification. This undermines the fundamental security assumptions of Ed25519-based cryptographic operations.

Root Cause

The root cause is an incomplete mathematical check in the subgroup validation function. The Ed25519 curve has a cofactor of 8, meaning there are small subgroup attacks possible if points outside the main prime-order subgroup are accepted. The original code only checked if X == 0 after multiplying by the group order, but failed to verify that Y == Z (which would confirm the point is the identity element). This oversight allowed certain invalid points to be incorrectly classified as valid members of the main cryptographic subgroup.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker could exploit this vulnerability by:

1. Submitting specially crafted elliptic curve points to applications that use crypto_core_ed25519_is_valid_point for validation
2. These malicious points would pass the incomplete validation check despite not being in the main cryptographic subgroup
3. Subsequent cryptographic operations using these invalid points could produce predictable or manipulable results
4. This could potentially lead to signature forgery, key recovery, or other cryptographic attacks depending on the application's specific use of the Ed25519 operations

 ge25519_is_on_main_subgroup(const ge25519_p3 *p)
 {
     ge25519_p3 pl;
+    fe25519    t;
 
     ge25519_mul_l(&pl, p);
 
-    return fe25519_iszero(pl.X);
+    fe25519_sub(t, pl.Y, pl.Z);
+
+    return fe25519_iszero(pl.X) & fe25519_iszero(t);
 }
 
 int

Source: GitHub Commit Update

The patch adds an additional check to verify that Y == Z (by computing Y - Z and checking if it's zero) alongside the existing X == 0 check. Both conditions must be true for the point to be considered valid, ensuring the result of the scalar multiplication is truly the identity element.

Detection Methods for CVE-2025-15444

Indicators of Compromise

• Unusual cryptographic operation failures or unexpected validation successes in Ed25519-based operations
• Log entries showing acceptance of elliptic curve points that should have been rejected
• Anomalous signature verification patterns in applications using Crypt::Sodium::XS
• Network traffic containing malformed or suspicious Ed25519 public keys or points

Detection Strategies

• Audit installed Perl module versions to identify instances of Crypt::Sodium::XS below version 0.000042
• Review application logs for cryptographic validation anomalies or unexpected Ed25519 operation results
• Monitor for patterns of input that may be testing point validation boundaries
• Implement runtime checks to verify Ed25519 point validity using multiple validation methods

Monitoring Recommendations

• Enable verbose logging for cryptographic operations in applications using libsodium or Crypt::Sodium::XS
• Deploy SentinelOne Singularity Platform to detect anomalous behavior in Perl applications and cryptographic library usage
• Establish baseline metrics for cryptographic validation success/failure rates to identify deviations
• Configure alerts for applications processing untrusted Ed25519 points from external sources

How to Mitigate CVE-2025-15444

Immediate Actions Required

• Upgrade Crypt::Sodium::XS to version 0.000042 or later immediately
• Update libsodium to version 1.0.20-stable (released January 3, 2026) or later on systems using the library directly
• Review all applications that process untrusted cryptographic input through Ed25519 operations
• Conduct security assessment of any systems that may have processed attacker-controlled elliptic curve points

Patch Information

The vulnerability has been addressed in Crypt::Sodium::XS version 0.000042, which includes libsodium 1.0.20-stable released on January 3, 2026. The fix adds an additional validation check in the ge25519_is_on_main_subgroup function to ensure both the X coordinate is zero and the Y coordinate equals the Z coordinate after scalar multiplication, properly confirming the point is the identity element.

For detailed patch information, see the GitHub Commit Update and MetaCPAN Library Changes.

Workarounds

• If immediate patching is not possible, avoid processing untrusted Ed25519 points through crypto_core_ed25519_is_valid_point
• Implement additional application-level validation for elliptic curve points before cryptographic operations
• Consider temporarily disabling features that accept external Ed25519 key material until patching is complete
• Isolate systems running vulnerable versions from processing cryptographic input from untrusted sources

# Upgrade Crypt::Sodium::XS via CPAN
cpan install Crypt::Sodium::XS

# Verify installed version
perl -MCrypt::Sodium::XS -e 'print $Crypt::Sodium::XS::VERSION'

# Verify libsodium version on system
pkg-config --modversion libsodium