CVE-2025-59941: Github.com/filecoin project/go f3 Go-f3 Vulnerable To Cached Justification Vulnerability
MODERATECVE-2025-59941 is a MODERATE (CVSS 5.9) go-f3 vulnerable to cached justification vulnerability (CWE-305: Authentication Bypass by Primary Weakness) affecting Github.com/filecoin project/go f3 libraries in the Go ecosystem. The issue involves go-f3 vulnerable to cached justification verification bypass. Remediation is available by upgrading affected packages to version 0.8.9.
CVE-2025-59941 at a Glance
Security Impact
CVSS: 5.9
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L).
How to Fix CVE-2025-59941
To remediate this vulnerability, upgrade all affected Github.com/filecoin project/go f3 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/filecoin-project/go-f3 to 0.8.9Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/filecoin-project/go-f3How to Check if You Are Affected
To determine whether your application is affected by CVE-2025-59941, inspect your project dependencies for Github.com/filecoin project/go f3:
inspect dependencies for github.com/filecoin-project/go-f3Analyze the terminal output to locate any version of Github.com/filecoin project/go f3 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.8.9), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-305: Authentication Bypass by Primary Weakness, where the authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error. In Github.com/filecoin project/go f3, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-59941 Affected Github.com/filecoin project/go f3 Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/filecoin-project/go-f3
|
Go |
< 0.8.9
|
0.8.9
|
References
Frequently Asked Questions
What is CVE-2025-59941?
Which Github.com/filecoin project/go f3 versions are affected?
What version fixes CVE-2025-59941?
Is github.com/filecoin-project/go-f3 affected?
What is the CVSS score of CVE-2025-59941?
What CWE is associated with CVE-2025-59941?
How can I check Go dependencies for CVE-2025-59941?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-7pq9-rf9p-wcrf",
"modified" : "2025-10-23T20:32:35Z",
"published" : "2025-09-29T20:40:02Z",
"aliases" : [ "CVE-2025-59941" ],
"summary" : "go-f3 Vulnerable to Cached Justification Verification Bypass",
"details" : "### Description\nA vulnerability exists in go-f3's justification verification caching mechanism where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by:\n1. First submitting a valid message with a correct justification\n2. Then reusing the same cached justification in contexts where it would normally be invalid\n\nThis occurs because the cached verification does not properly validate the relationship between the justification and the specific message context it's being used with.\n\n### Impact\n- Potential consensus integrity issues through invalid justification acceptance\n- Could affect network liveness if exploited systematically\n- May allow malicious actors to influence consensus decisions with invalid justifications\n- Requires significant power (350+ TiB due to power table rounding) to meaningfully exploit\n- It would also be difficult to exploit in a synchronised fashion, such that >1/3 of the network goes down at one time. This isn't a one-msg panic, where you can spam it and bring everyone down, because every node will have a different amount of memory andmany SPs also run redundant lotus nodes. \n\n### Patches\nThe fix was merged and released with go-f3 0.8.9. All node software (Lotus, Forest, Venus) are using a patched version of go-f3 with their updates for the nv27 network upgrade.\n\n### Workarounds\nThe are no immediate workarounds available. Nodes should upgrade to the patched version, which they will have done if participating in nv27 on Filecoin mainnet.\n\n### Credits\nThe bug was reported by @lgprbs via our bug bounty program. Thank you for the contributions.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/filecoin-project/go-f3"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.8.9"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/filecoin-project/go-f3/security/advisories/GHSA-7pq9-rf9p-wcrf"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-59941"
}, {
"type" : "WEB",
"url" : "https://github.com/filecoin-project/go-f3/commit/76fff18cf07b21baccf537024bdb2fb41f75f6e2#diff-e1f646cea41790e1642e4e649c9e3c526344736d67222201703e1c29c23e9625"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/filecoin-project/go-f3"
}, {
"type" : "WEB",
"url" : "https://pkg.go.dev/vuln/GO-2025-3989"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-305" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2025-09-29T20:40:02Z",
"nvd_published_at" : "2025-09-29T23:15:32Z"
}
}