CVE-2025-59941

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-59941", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-09-23T14:33:49.505Z", "datePublished": "2025-09-29T22:38:42.589Z", "dateUpdated": "2025-09-30T14:13:56.958Z"}, "containers": {"cna": {"title": "go-f3 is Vulnerable to Cached Justification Verification Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-305", "lang": "en", "description": "CWE-305: Authentication Bypass by Primary Weakness", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/filecoin-project/go-f3/security/advisories/GHSA-7pq9-rf9p-wcrf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/filecoin-project/go-f3/security/advisories/GHSA-7pq9-rf9p-wcrf"}, {"name": "https://github.com/filecoin-project/go-f3/commit/76fff18cf07b21baccf537024bdb2fb41f75f6e2#diff-e1f646cea41790e1642e4e649c9e3c526344736d67222201703e1c29c23e9625", "tags": ["x_refsource_MISC"], "url": "https://github.com/filecoin-project/go-f3/commit/76fff18cf07b21baccf537024bdb2fb41f75f6e2#diff-e1f646cea41790e1642e4e649c9e3c526344736d67222201703e1c29c23e9625"}], "affected": [{"vendor": "filecoin-project", "product": "go-f3", "versions": [{"version": "< 0.8.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-29T22:38:42.589Z"}, "descriptions": [{"lang": "en", "value": "go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by submitting a valid message with a correct justification and then reusing the same cached justification in contexts where it would normally be invalid. This occurs because the cached verification does not properly validate the relationship between the justification and the specific message context it's being used with. This issue is fixed in version 0.8.9."}], "source": {"advisory": "GHSA-7pq9-rf9p-wcrf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-30T14:13:50.946398Z", "id": "CVE-2025-59941", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T14:13:56.958Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59941", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-30T14:13:50.946398Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T14:13:54.407Z"}}], "cna": {"title": "go-f3 is Vulnerable to Cached Justification Verification Bypass", "source": {"advisory": "GHSA-7pq9-rf9p-wcrf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "filecoin-project", "product": "go-f3", "versions": [{"status": "affected", "version": "< 0.8.9"}]}], "references": [{"url": "https://github.com/filecoin-project/go-f3/security/advisories/GHSA-7pq9-rf9p-wcrf", "name": "https://github.com/filecoin-project/go-f3/security/advisories/GHSA-7pq9-rf9p-wcrf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/filecoin-project/go-f3/commit/76fff18cf07b21baccf537024bdb2fb41f75f6e2#diff-e1f646cea41790e1642e4e649c9e3c526344736d67222201703e1c29c23e9625", "name": "https://github.com/filecoin-project/go-f3/commit/76fff18cf07b21baccf537024bdb2fb41f75f6e2#diff-e1f646cea41790e1642e4e649c9e3c526344736d67222201703e1c29c23e9625", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by submitting a valid message with a correct justification and then reusing the same cached justification in contexts where it would normally be invalid. This occurs because the cached verification does not properly validate the relationship between the justification and the specific message context it's being used with. This issue is fixed in version 0.8.9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-305", "description": "CWE-305: Authentication Bypass by Primary Weakness"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-29T22:38:42.589Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59941", "state": "PUBLISHED", "dateUpdated": "2025-09-30T14:13:56.958Z", "dateReserved": "2025-09-23T14:33:49.505Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-09-29T22:38:42.589Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "go-f3", "vendor": "filecoin-project", "versions": [{"status": "affected", "version": "< 0.8.9"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:filecoin:go-f3:*:*:*:*:*:*:*:*", "matchCriteriaId": "CA0753C4-2D27-4A25-9127-17EDE1C0FD26", "versionEndExcluding": "0.8.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by submitting a valid message with a correct justification and then reusing the same cached justification in contexts where it would normally be invalid. This occurs because the cached verification does not properly validate the relationship between the justification and the specific message context it's being used with. This issue is fixed in version 0.8.9."}, {"lang": "es", "value": "go-f3 es una implementaci\u00f3n en Golang de Fast Finality para Filecoin (F3). En las versiones 0.8.8 e inferiores, el mecanismo de cach\u00e9 de verificaci\u00f3n de justificaci\u00f3n de go-f3 tiene una vulnerabilidad donde los resultados de la verificaci\u00f3n se almacenan en cach\u00e9 sin considerar adecuadamente el contexto del mensaje. Un atacante puede eludir la verificaci\u00f3n de justificaci\u00f3n al enviar un mensaje v\u00e1lido con una justificaci\u00f3n correcta y luego reutilizar la misma justificaci\u00f3n almacenada en cach\u00e9 en contextos donde normalmente ser\u00eda inv\u00e1lida. Esto ocurre porque la verificaci\u00f3n almacenada en cach\u00e9 no valida adecuadamente la relaci\u00f3n entre la justificaci\u00f3n y el contexto espec\u00edfico del mensaje con el que se est\u00e1 utilizando. Este problema est\u00e1 solucionado en la versi\u00f3n 0.8.9."}], "id": "CVE-2025-59941", "lastModified": "2026-10-09T09:10:00.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59941", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-30T14:13:50.946398Z", "version": "2.0.3"}}]}, "published": "2025-09-29T23:15:32.133", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/filecoin-project/go-f3/commit/76fff18cf07b21baccf537024bdb2fb41f75f6e2#diff-e1f646cea41790e1642e4e649c9e3c526344736d67222201703e1c29c23e9625"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/filecoin-project/go-f3/security/advisories/GHSA-7pq9-rf9p-wcrf"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-305"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-09-30T08:47:42.259641+00:00", "updated": "2025-09-30T08:47:42.259689+00:00", "vendors": ["filecoin", "filecoin$PRODUCT$go-f3"]}