PT-2025-39916 · Go-F3 · Go-F3

Lgprbs · Published 2025-09-29 · Updated 2025-10-27 · CVE-2025-59941

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions go-f3 versions 0.8.8 and below

Description go-f3’s justification verification caching mechanism improperly caches verification results without considering the message context. An attacker can bypass justification verification by submitting a valid message with a correct justification and then reusing the same cached justification in contexts where it would normally be invalid. The cached verification does not validate the relationship between the justification and the specific message context. Exploitation requires significant computational power (350+ TiB) and coordinated timing to impact a substantial portion of the network.

Recommendations Upgrade to go-f3 version 0.8.9 or later.

Exploit

Fix

Weakness Enumeration

CWE-305

Related Identifiers

CVE-2025-59941

GHSA-7PQ9-RF9P-WCRF

GO-2025-3989

OPENSUSE-SU-2025:15666-1

SUSE-SU-2025:3799-1

Affected Products

Go-F3

References · 50

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59941.json · Exploit
• https://github.com/filecoin-project/go-f3/security/advisories/GHSA-7pq9-rf9p-wcrf · Vendor Advisory
• https://github.com/filecoin-project/go-f3/commit/76fff18cf07b21baccf537024bdb2fb41f75f6e2#diff-e1f646cea41790e1642e4e649c9e3c526344736d67222201703e1c29c23e9625 · Patch
• https://osv.dev/vulnerability/GHSA-7pq9-rf9p-wcrf · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3799-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59941 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15666-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3989 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59941 · Vendor Advisory
• https://github.com/filecoin-project/go-f3 · Note
• https://twitter.com/VulmonFeeds/status/1972905280154272212 · Twitter Post
• https://suse.com/security/cve/CVE-2025-59350 · Note
• https://suse.com/security/cve/CVE-2025-59346 · Note
• https://suse.com/security/cve/CVE-2025-23266 · Note
• https://suse.com/security/cve/CVE-2024-58267 · Note