What is the CVSS score of CVE-2025-59941?

CVE-2025-59941 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Go F3 are affected by CVE-2025-59941?

Organizations using go-f3 should be aware of moderate risk from CVE-2025-59941 rated CVSS 5.9. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-59941?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Go F3 CVE-2025-59941

MEDIUM

Authentication Bypass by Primary Weakness (CWE-305)

2025-09-29 security-advisories@github.com

Authentication Bypass Go F3 Suse

5.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L

SUSE

MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:14 vuln.today

Patch released

Mar 28, 2026 - 19:14 nvd

Patch available

CVE Published

Sep 29, 2025 - 23:15 nvd

MEDIUM 5.9

DescriptionGitHub Advisory

go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by submitting a valid message with a correct justification and then reusing the same cached justification in contexts where it would normally be invalid. This occurs because the cached verification does not properly validate the relationship between the justification and the specific message context it's being used with. This issue is fixed in version 0.8.9.

AnalysisAI

go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable.

Technical ContextAI

This vulnerability is classified under CWE-305. go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, go-f3's justification verification caching mechanism has a vulnerability where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by submitting a valid message with a correct justification and then reusing the same cached justification in contexts where it would normally be invalid. This occurs because the cached verification does not properly validate the relationship between the justification and the specific message context it's being used with. This issue is fixed in version 0.8.9. Affected products include: Filecoin Go-F3. Version information: version 0.8.9..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.