go-f3 module vulnerable to integer overflow leading to panic
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-190 and the CVSS impact.
Summary
go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.6 and below, go-f3 panics when it validates a "poison" messages causing Filecoin nodes consuming F3 messages to become vulnerable. A "poison" message can can cause integer overflow in the signer index validation, which can cause the whole node to crash. These malicious messages aren't self-propagating since the bug is in the validator. An attacker needs to directly send the message to all targets. This issue is fixed in version 0.8.7.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| filecoin-project | go-f3 | before 0.8.7 | 0.8.7 | Patch available | CNA |
| — | github.com/filecoin-project/go-f3 (Go) | before 0.8.7 | 0.8.7 | Patch available | GHSA-g99p-47x7-mq88 |
- go-f3 Vendorfilecoin-project Affected before 0.8.7 Fixed in 0.8.7 Patch available CNA
- github.com/filecoin-project/go-f3 (Go) Vendor— Affected before 0.8.7 Fixed in 0.8.7 Patch available GHSA-g99p-47x7-mq88
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:filecoin:go-f3:*:*:*:*:*:*:*:* | before 0.8.7 | Vulnerable | filecoin-project |
- cpe:2.3:a:filecoin:go-f3:*:*:*:*:*:*:*:* Versions before 0.8.7 Vulnerable ·filecoin-project
Remediation
- Fix · CNA go-f3 (filecoin-project) Fixed in 0.8.7
- Fix · GHSA-g99p-47x7-mq88 github.com/filecoin-project/go-f3 (Go) Fixed in 0.8.7 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-59942
- 2026-10-03 Alias added: GHSA-g99p-47x7-mq88
References
More filecoin-project Go-f3 vulnerabilities
- TI-2025-37329 go-f3 is Vulnerable to Cached Justification Verification Bypass CVSS 3.1MEDIUM 6.5
Sources
- CVE-2025-59942 · CVE Program
- CVE-2025-59942 · NVD
- FIRST EPSS
- GHSA-g99p-47x7-mq88 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences