CVE-2025-59942
Last modified
CVE-2025-59942 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.6 and below, go-f3 panics when it validates a "poison" messages causing Filecoin nodes consuming F3 messages to become vulnerable. EPSS estimates a 0.31% chance of exploitation in the next 30 days.
Description
go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.6 and below, go-f3 panics when it validates a "poison" messages causing Filecoin nodes consuming F3 messages to become vulnerable. A "poison" message can can cause integer overflow in the signer index validation, which can cause the whole node to crash. These malicious messages aren't self-propagating since the bug is in the validator. An attacker needs to directly send the message to all targets. This issue is fixed in version 0.8.7.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Filecoin | Go-F3 | < 0.8.7 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-59942?
How severe is CVE-2025-59942?
How do I fix CVE-2025-59942?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-59937go-mail is a comprehensive library for sending mails with Go…9.1
- CVE-2025-59938Wazuh is a free and open source platform used for threat pre…6.5
- CVE-2025-59939WeGIA is a Web manager for charitable institutions. Prior to…8.8
- CVE-2025-5994A multi-vendor cache poisoning vulnerability named 'Rebirthd…8.7
- CVE-2025-59940mkdocs-include-markdown-plugin is an Mkdocs Markdown include…6.5
- CVE-2025-59941go-f3 is a Golang implementation of Fast Finality for Fileco…6.5
- CVE-2025-59943phpMyFAQ is an open source FAQ web application. Versions 4.0…9.8
- CVE-2025-59944Cursor is a code editor built for programming with AI. Versi…9.8
- CVE-2025-59945SysReptor is a fully customizable pentest reporting platform…8.1
- CVE-2025-59946NanoMQ MQTT Broker (NanoMQ) is an Edge Messaging Platform. P…7.5
- CVE-2025-59947NanoMQ is a messaging broker/bus for IoT Edge & SDV. Version…9
- CVE-2025-59948FreshRSS is a free, self-hostable RSS aggregator. Versions 1…5.4
Are you affected by CVE-2025-59942?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST