External risk intelligence

Crypt::Sodium::XS Perl Module Invalid Elliptic Curve Point Validation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-15444

The vulnerability exists in a Perl cryptographic library module. While it may be used in internet-facing web applications or APIs that perform custom cryptographic operations, the module itself is a developer-level dependency rather than a standalone service or appliance, making its exposure dependent on the specific implementation patterns of the software that incorporates it.

Iamb Crypt\

before 0.000042

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Crypt::Sodium::XS module for Perl, stemming from an underlying issue in the libsodium cryptography library. This flaw could potentially allow unauthorized access to sensitive data or disruption of services if specific, atypical cryptographic operations are performed with untrusted data. The updated version of the module addresses this by incorporating a corrected libsodium library.

Cryptography library has a serious flaw.
Could impact custom crypto, untrusted data.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target systems using the Crypt::Sodium::XS Perl module, which incorporates a vulnerable version of the libsodium library. This vulnerability arises from improper handling of checks for valid elliptic curve points in specific, atypical cryptographic scenarios. If an attacker can provide crafted, untrusted data to the `crypto_core_ed25519_is_valid_point` function, they might be able to bypass validation checks, potentially leading to the compromise of cryptographic integrity and security.

No special access needed.
Malicious data to specific function.
Compromise cryptographic integrity.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the integrity of cryptographic operations when using certain custom cryptography or untrusted data with the `crypto_core_ed25519_is_valid_point` function. It may allow invalid points to be accepted, potentially impacting security assurances when not properly handled by the application.

Cryptographic integrity of operations.
Atypical use of specific cryptographic functions.
Compromised security assurances.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the Crypt::Sodium::XS Perl module, which relies on the libsodium cryptography library. The immediate concern lies with application owners and platform teams responsible for managing Perl dependencies and their underlying libraries. The first practical step is to inventory all systems running the affected module, confirm its reachability and business criticality, and identify the accountable owner for remediation planning.

Application owners should own the remediation.
Verify if the module is used and reachable.
Plan maintenance for library updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Crypt::Sodium::XS module?

Crypt::Sodium::XS is a Perl software module that provides a bridge to the libsodium library. Developers use it to integrate high-level cryptographic functions—such as encryption, decryption, and digital signatures—into Perl-based applications. It acts as a wrapper, enabling Perl programs to leverage libsodium's secure, industry-standard cryptographic tools.

How does CVE-2025-15444 affect cryptographic security?

This vulnerability is classified under CWE-347, which relates to improper verification of cryptographic signatures. In this case, the underlying libsodium library fails to correctly validate certain elliptic curve points. By accepting invalid points, the software might bypass security checks, potentially allowing an attacker to weaken the cryptographic integrity of operations performed by the application.

Does any input trigger this vulnerability?

No, common or standard cryptographic tasks are typically not affected. The issue is specific to atypical use cases where custom cryptographic logic passes untrusted, maliciously crafted data directly to the 'crypto_core_ed25519_is_valid_point' function. If your application does not handle raw, untrusted data in this specific mathematical context, the bug is unlikely to be triggered.

How do I know if my system is at risk?

Halo Surface Signal notes that since this is a developer-level dependency rather than a standalone service, risk depends on how your software uses it. You should investigate if your Perl applications are internet-facing or process untrusted inputs, especially those performing custom cryptographic operations, as these implementation patterns increase the likelihood of exposure.

What is the first step to address CVE-2025-15444?

Your initial priority is to perform an inventory of your environment to locate all systems running the affected Crypt::Sodium::XS module. Once you identify these instances, assess whether they are reachable by untrusted parties and determine which applications utilize the vulnerable cryptographic functions. Finally, coordinate with your development team to update the module to version 0.000042 or later.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.