Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2025-59941: go-f3 may let attackers skip justification checks
CVE-2025-59941 · published 1 year ago
Summary
Versions 0.8.8 and earlier of the go-f3 library for Filecoin cache verification results without tying them to the specific message. This lets a malicious party reuse a previously approved justification to make an invalid message appear valid. Upgrade to version 0.8.9 or later to close the gap.
What to do
- Update github.com filecoin-project to version 0.8.9.
- Update filecoin go-f3 to version 0.8.9 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | filecoin-project |
< 0.8.9 Fix: upgrade to 0.8.9
|
| – | filecoin | go-f3 |
< 0.8.9 cpe:2.3:a:filecoin:go-f3:*:*:*:*:*:*:*:* |
Original advisory text
go-f3 is Vulnerable to Cached Justification Verification Bypass
go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by submitting a valid message with a correct justification and then reusing the same cached justification in contexts where it would normally be invalid. This occurs because the cached verification does not properly validate the relationship between the justification and the specific message context it's being used with. This issue is fixed in version 0.8.9.
References
- https://pkg.go.dev/vuln/GO-2025-3989
- https://github.com/advisories/GHSA-7pq9-rf9p-wcrf
- https://github.com/filecoin-project/go-f3/security/advisories/GHSA-7pq9-rf9p-wcr... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-59941 Vendor Advisory
- https://github.com/filecoin-project/go-f3/commit/76fff18cf07b21baccf537024bdb2fb... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59941... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-305Authentication Bypass by Primary Weakness
Timeline
Published29 Sep 2025
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta