CVE-2025-59942: Github.com/filecoin project/go f3 Go-f3 Module Vulnerable To Integer Vulnerability
HIGHCVE-2025-59942 is a HIGH (CVSS 7.5) go-f3 module vulnerable to integer vulnerability (CWE-190: Integer Overflow or Wraparound) affecting Github.com/filecoin project/go f3 libraries in the Go ecosystem. The issue involves go-f3 module vulnerable to integer overflow leading to panic. Remediation is available by upgrading affected packages to version 0.8.7.
CVE-2025-59942 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How to Fix CVE-2025-59942
To remediate this vulnerability, upgrade all affected Github.com/filecoin project/go f3 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/filecoin-project/go-f3 to 0.8.7Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/filecoin-project/go-f3How to Check if You Are Affected
To determine whether your application is affected by CVE-2025-59942, inspect your project dependencies for Github.com/filecoin project/go f3:
inspect dependencies for github.com/filecoin-project/go-f3Analyze the terminal output to locate any version of Github.com/filecoin project/go f3 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.8.7), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-190: Integer Overflow or Wraparound, where the product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. this occurs when an integer value is incremented to a value that is too large to store in the associated representation. when this occurs, the value may become a very small or negative number. In Github.com/filecoin project/go f3, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-59942 Affected Github.com/filecoin project/go f3 Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/filecoin-project/go-f3
|
Go |
< 0.8.7
|
0.8.7
|
References
Frequently Asked Questions
What is CVE-2025-59942?
Which Github.com/filecoin project/go f3 versions are affected?
What version fixes CVE-2025-59942?
Is github.com/filecoin-project/go-f3 affected?
What is the CVSS score of CVE-2025-59942?
What CWE is associated with CVE-2025-59942?
How can I check Go dependencies for CVE-2025-59942?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-g99p-47x7-mq88",
"modified" : "2025-10-23T20:32:56Z",
"published" : "2025-09-29T20:40:08Z",
"aliases" : [ "CVE-2025-59942" ],
"summary" : "go-f3 module vulnerable to integer overflow leading to panic",
"details" : "### Impact\n\nFilecoin nodes consuming F3 messages are vulnerable. go-f3 panics when it validates a \"poison\" messages. A \"poison\" message can can cause integer overflow in the signer index validation. In Lotus' case, the whole node will crash. \n\nThere is no barrier to entry. An attacker doesn't need any power to pull off this attack.\n\nThese malicious messages aren't self-propagating since the bug is in the validator. An attacker needs to directly send the message to all targets.\n\n\n\n### Patches\nThe fix was merged and released with go-f3 0.8.7. All node software (Lotus, Forest, Venus) are using a patched version of go-f3 with their updates for the nv27 network upgrade.\n\ngo-f3 now does proper overflow checking using `math.MaxInt64` comparison and returns error `\"justificationPower overflow\"` when overflow would occur.\n\n### Workarounds\nThe are no immediate workarounds available. Nodes should upgrade to the patched version, which they will have done if participating in nv27 on Filecoin mainnet.\n\n### Credits\nThe initial finding(unrelated path) was reported by [0xNirix](https://github.com/0xNirix) via bug bounty program which wasn't high issue. The further digging by developers led to this finding. Thank you for the contributions.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/filecoin-project/go-f3"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.8.7"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/filecoin-project/go-f3/security/advisories/GHSA-g99p-47x7-mq88"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-59942"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/filecoin-project/go-f3"
}, {
"type" : "WEB",
"url" : "https://pkg.go.dev/vuln/GO-2025-3990"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-190" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2025-09-29T20:40:08Z",
"nvd_published_at" : "2025-09-29T23:15:32Z"
}
}