CVE-2025-59941: go-f3 is Vulnerable to Cached Justification Verification Bypass

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-29 · updated 2026-10-09
Weakness: CWE-305

Description

go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by submitting a valid message with a correct justification and then reusing the same cached justification in contexts where it would normally be invalid. This occurs because the cached verification does not properly validate the relationship between the justification and the specific message context it's being used with. This issue is fixed in version 0.8.9.

Affected products

filecoin-project go-f3: before 0.8.9 — fixed in 0.8.9

How to fix

Upgrade to a fixed version: filecoin-project go-f3 0.8.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-59941 or the next vulnerability affects your stack