CVE-2025-59941

go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by submitting a valid message with a correct justification and then reusing the same cached justification in contexts where it would normally be invalid. This occurs because the cached verification does not properly validate the relationship between the justification and the specific message context it's being used with. This issue is fixed in version 0.8.9.

• CWE-305

• https://github.com/filecoin-project/go-f3/commit/76fff18cf07b21baccf537024bdb2fb41f75f6e2#diff-e1f646cea41790e1642e4e649c9e3c526344736d67222201703e1c29c23e9625Patch
• https://github.com/filecoin-project/go-f3/security/advisories/GHSA-7pq9-rf9p-wcrfVendor Advisory

Published

Sep 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59936get-jwks contains fetch utils for JWKS keys. In versions pri…9.4
• CVE-2025-59937go-mail is a comprehensive library for sending mails with Go…9.1
• CVE-2025-59938Wazuh is a free and open source platform used for threat pre…6.5
• CVE-2025-59939WeGIA is a Web manager for charitable institutions. Prior to…8.8
• CVE-2025-5994A multi-vendor cache poisoning vulnerability named 'Rebirthd…8.7
• CVE-2025-59940mkdocs-include-markdown-plugin is an Mkdocs Markdown include…6.5
• CVE-2025-59942go-f3 is a Golang implementation of Fast Finality for Fileco…7.5
• CVE-2025-59943phpMyFAQ is an open source FAQ web application. Versions 4.0…9.8
• CVE-2025-59944Cursor is a code editor built for programming with AI. Versi…9.8
• CVE-2025-59945SysReptor is a fully customizable pentest reporting platform…8.1
• CVE-2025-59946NanoMQ MQTT Broker (NanoMQ) is an Edge Messaging Platform. P…7.5
• CVE-2025-59947NanoMQ is a messaging broker/bus for IoT Edge & SDV. Version…9