Critical
Security advisory
An issue was discovered in Noise-Java through 2020-08-27. ChaChaPolyCipherState.encryptWithAd() allows out-of-bounds access.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-25021
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:36 UTC · Revision 1
Source evidence
An issue was discovered in Noise-Java through 2020-08-27. ChaChaPolyCipherState.encryptWithAd() allows out-of-bounds access.
osv:CVE-2020-25021
Complete source record
{
"id": "4e3e00a29f3df8b324560b384b8b123f1a7467c68c0020bf569ba95890cd98c5",
"url": "https://osv.dev/vulnerability/CVE-2020-25021",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-25021",
"summary": "An issue was discovered in Noise-Java through 2020-08-27. ChaChaPolyCipherState.encryptWithAd() allows out-of-bounds access.",
"evidence": "osv:CVE-2020-25021",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2020-25021",
"aliases": [
"CVE-2020-25021"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/rweather/noise-java",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "18e86b6f8bea7326934109aa9ffa705ebf4bde90"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"fixed": "18e86b6f8bea7326934109aa9ffa705ebf4bde90"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-25021.json",
"vanir_signatures": [
{
"id": "CVE-2020-25021-0b3f2627",
"digest": {
"length": 1152,
"function_hash": "31696553789061348543954821442458380204"
},
"source": "https://github.com/rweather/noise-java/commit/18e86b6f8bea7326934109aa9ffa705ebf4bde90",
"target": {
"file": "src/main/java/com/southernstorm/noise/protocol/AESGCMOnCtrCipherState.java",
"function": "encryptWithAd"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-25021-1283079e",
"digest": {
"length": 1047,
"function_hash": "66898851433788692633400536516760569337"
},
"source": "https://github.com/rweather/noise-java/commit/18e86b6f8bea7326934109aa9ffa705ebf4bde90",
"target": {
"file": "src/main/java/com/southernstorm/noise/protocol/AESGCMFallbackCipherState.java",
"function": "decryptWithAd"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-25021-1a516728",
"digest": {
"length": 956,
"function_hash": "163635587722489269482405846284454599759"
},
"source": "https://github.com/rweather/noise-java/commit/18e86b6f8bea7326934109aa9ffa705ebf4bde90",
"target": {
"file": "src/main/java/com/southernstorm/noise/protocol/ChaChaPolyCipherState.java",
"function": "decryptWithAd"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-25021-2f800f26",
"digest": {
"threshold": 0.9,
"line_hashes": [
"248084885838146253345771771269370804417",
"140250448064229028853599927670278424096",
"330457463062443688678293515174674062873",
"55048163030964998224381313280347382784",
"306931882619861584162923184468321031823",
"311748548483982027723743522572240069704",
"77320385515136150135576332425983362513",
"83644315993127178577893805666991880187",
"89473546135236005693704407250573942399",
"330457463062443688678293515174674062873",
"55048163030964998224381313280347382784",
"188697535042500821947264476458022671669",
"194008130026071319719457212564746600541",
"194829075617753068576068964296557370506",
"288796742773005041722011406505574108000",
"281014321094192436150097193773785830219",
"217004687368679366954793008857463832015",
"280030657105869282452504007557863416519",
"45788093309745126740486596840635536428",
"228866721525578960286648948301435841419"
]
},
"source": "https://github.com/rweather/noise-java/commit/18e86b6f8bea7326934109aa9ffa705ebf4bde90",
"target": {
"file": "src/main/java/com/southernstorm/noise/protocol/AESGCMOnCtrCipherState.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-25021-3d884385",
"digest": {
"length": 1402,
"function_hash": "267246413992864573047282012333591911877"
},
"source": "https://github.com/rweather/noise-java/commit/18e86b6f8bea7326934109aa9ffa705ebf4bde90",
"target": {
"file": "src/main/java/com/southernstorm/noise/protocol/AESGCMOnCtrCipherState.java",
"function": "decryptWithAd"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-25021-5c06e154",
"digest": {
"length": 799,
"function_hash": "314004612045279238183079182966135327988"
},
"source": "https://github.com/rweather/noise-java/commit/18e86b6f8bea7326934109aa9ffa705ebf4bde90",
"target": {
"file": "src/main/java/com/southernstorm/noise/protocol/AESGCMFallbackCipherState.java",
"function": "encryptWithAd"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-25021-77136b95",
"digest": {
"threshold": 0.9,
"line_hashes": [
"264329028219938384351945693844529751397",
"275378059430341761265592928712872113057",
"330457463062443688678293515174674062873",
"55048163030964998224381313280347382784",
"14113105530923163521229694919607104781",
"236868339578648112956584501549662705974",
"117432426538188597543604590651805810898",
"83644315993127178577893805666991880187",
"89473546135236005693704407250573942399",
"330457463062443688678293515174674062873",
"55048163030964998224381313280347382784",
"188697535042500821947264476458022671669",
"194008130026071319719457212564746600541",
"194829075617753068576068964296557370506",
"288796742773005041722011406505574108000",
"281014321094192436150097193773785830219",
"217004687368679366954793008857463832015",
"180123066045396832286909635187167941824",
"266252356298025946804680655516106737472",
"320247887393656219471853600774097330932"
]
},
"source": "https://github.com/rweather/noise-java/commit/18e86b6f8bea7326934109aa9ffa705ebf4bde90",
"target": {
"file": "src/main/java/com/southernstorm/noise/protocol/ChaChaPolyCipherState.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-25021-c22025f5",
"digest": {
"length": 684,
"function_hash": "14823959838769480757266236490617897185"
},
"source": "https://github.com/rweather/noise-java/commit/18e86b6f8bea7326934109aa9ffa705ebf4bde90",
"target": {
"file": "src/main/java/com/southernstorm/noise/protocol/ChaChaPolyCipherState.java",
"function": "encryptWithAd"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-25021-df74b1c4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"248084885838146253345771771269370804417",
"140250448064229028853599927670278424096",
"330457463062443688678293515174674062873",
"55048163030964998224381313280347382784",
"14113105530923163521229694919607104781",
"236868339578648112956584501549662705974",
"117432426538188597543604590651805810898",
"83644315993127178577893805666991880187",
"89473546135236005693704407250573942399",
"330457463062443688678293515174674062873",
"55048163030964998224381313280347382784",
"188697535042500821947264476458022671669",
"194008130026071319719457212564746600541",
"194829075617753068576068964296557370506",
"288796742773005041722011406505574108000",
"281014321094192436150097193773785830219",
"217004687368679366954793008857463832015",
"180123066045396832286909635187167941824",
"266252356298025946804680655516106737472",
"320247887393656219471853600774097330932"
]
},
"source": "https://github.com/rweather/noise-java/commit/18e86b6f8bea7326934109aa9ffa705ebf4bde90",
"target": {
"file": "src/main/java/com/southernstorm/noise/protocol/AESGCMFallbackCipherState.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:57:27Z"
}
}
],
"modified": "2026-10-20T13:57:27.956118482Z",
"provider": "osv",
"references": [
"https://github.com/rweather/noise-java/pull/12",
"https://github.com/rweather/noise-java/commit/18e86b6f8bea7326934109aa9ffa705ebf4bde90"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:noise-java_project:noise-java:*:*:*:*:*:*:*:*"
],
"vendor_product": "noise-java_project:noise-java",
"extracted_events": [
{
"range": [
{
"last_affected": "2020-08-27"
}
],
"source": "CPE_RANGE"
}
]
},
{
"extracted_events": [
{
"range": [
{
"last_affected": "2020-08-27"
}
],
"source": "DESCRIPTION"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-25021",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388456,
"published_at": "2020-09-04T04:15:12.14+00:00"
}