{"id":"EUVD-2025-31620","enisaUuid":"3f318da3-774d-3f99-8177-c80913a2288e","description":"go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.6 and below, go-f3 panics when it validates a \"poison\" messages causing Filecoin nodes consuming F3 messages to become vulnerable. A \"poison\" message can can cause integer overflow in the signer index validation, which can cause the whole node to crash. These malicious messages aren\u0027t self-propagating since the bug is in the validator. An attacker needs to directly send the message to all targets. This issue is fixed in version 0.8.7.","datePublished":"Sep 29, 2025, 10:50:36 PM","dateUpdated":"Sep 30, 2025, 1:51:13 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/filecoin-project/go-f3/security/advisories/GHSA-g99p-47x7-mq88\n","aliases":"CVE-2025-59942\nGHSA-g99p-47x7-mq88\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"e7c4a504-37cb-310c-a1cf-0a6311c52025","product":{"name":"go-f3","vendor":{"name":"filecoin-project"}},"product_version":"\u003c 0.8.7"}],"enisaIdVendor":[{"id":"baeee2fd-7a37-38ee-992b-b4067521265b","vendor":{"name":"filecoin-project"}}],"enisaIdVulnerability":[{"id":"236b16a4-f150-3790-994e-d72f5e5c219c","vulnerability":{"id":"CVE-2025-59942","description":"go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.6 and below, go-f3 panics when it validates a \"poison\" messages causing Filecoin nodes consuming F3 messages to become vulnerable. A \"poison\" message can can cause integer overflow in the signer index validation, which can cause the whole node to crash. These malicious messages aren\u0027t self-propagating since the bug is in the validator. An attacker needs to directly send the message to all targets. This issue is fixed in version 0.8.7.","datePublished":"Sep 29, 2025, 10:50:36 PM","dateUpdated":"Sep 30, 2025, 1:51:13 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/filecoin-project/go-f3/security/advisories/GHSA-g99p-47x7-mq88\n","enisa_id":"EUVD-2025-31620\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Nov 2, 2026, 7:14:43 AM","vulnerabilityProduct":[{"id":"3a049a51-215e-3b31-bcfe-3d760099b7e8","product":{"name":"go-f3","vendor":{"name":"filecoin-project"}},"product_version":"\u003c 0.8.7"}],"vulnerabilityVendor":[{"id":"fbbed0e0-bddc-3c45-8cfa-f6fb7e4b90f7","vendor":{"name":"filecoin-project"}}]}},{"id":"84ea8eb4-265c-316e-80af-dbd133c7ce59","vulnerability":{"id":"GHSA-g99p-47x7-mq88","description":"go-f3 module vulnerable to integer overflow leading to panic","datePublished":"Sep 29, 2025, 8:40:08 PM","dateUpdated":"Oct 23, 2025, 8:32:56 PM","baseScore":0.0,"references":"https://github.com/filecoin-project/go-f3/security/advisories/GHSA-g99p-47x7-mq88\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-59942\nhttps://github.com/filecoin-project/go-f3\nhttps://pkg.go.dev/vuln/GO-2025-3990\n","enisa_id":"EUVD-2025-31620\n","aliases":"CVE-2025-59942\nGHSA-g99p-47x7-mq88\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:55:38 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"17f2825d-9403-372e-bb3b-3b19536f5dcb","advisory":{"id":"openSUSE-SU-2025:15666-1","description":"govulncheck-vulndb-0.0.20251023T162509-1.1 on GA media","summary":"govulncheck-vulndb-0.0.20251023T162509-1.1 on GA media","datePublished":"Oct 24, 2025, 12:00:00 AM","dateUpdated":"Sep 20, 2026, 9:43:48 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15666-1.json\nhttps://www.suse.com/security/cve/CVE-2024-58260/\nhttps://www.suse.com/security/cve/CVE-2024-58267/\nhttps://www.suse.com/security/cve/CVE-2025-23266/\nhttps://www.suse.com/security/cve/CVE-2025-23267/\nhttps://www.suse.com/security/cve/CVE-2025-54468/\nhttps://www.suse.com/security/cve/CVE-2025-55191/\nhttps://www.suse.com/security/cve/CVE-2025-59163/\nhttps://www.suse.com/security/cve/CVE-2025-59531/\nhttps://www.suse.com/security/cve/CVE-2025-59537/\nhttps://www.suse.com/security/cve/CVE-2025-59538/\nhttps://www.suse.com/security/cve/CVE-2025-59823/\nhttps://www.suse.com/security/cve/CVE-2025-59824/\nhttps://www.suse.com/security/cve/CVE-2025-59941/\nhttps://www.suse.com/security/cve/CVE-2025-59942/\nhttps://www.suse.com/security/cve/CVE-2025-59956/\nhttps://www.suse.com/security/cve/CVE-2025-61595/\nhttps://www.suse.com/security/cve/CVE-2025-61926/\n","aliases":"CVE-2024-58260\nCVE-2024-58267\nCVE-2025-23266\nCVE-2025-23267\nCVE-2025-54468\nCVE-2025-55191\nCVE-2025-59163\nCVE-2025-59531\nCVE-2025-59537\nCVE-2025-59538\nCVE-2025-59823\nCVE-2025-59824\nCVE-2025-59941\nCVE-2025-59942\nCVE-2025-59956\nCVE-2025-61595\nCVE-2025-61926\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"069bc116-e90a-35da-be73-2573dc2bb814","product":{"name":"govulncheck-vulndb-0.0.20251023T162509-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"27510a90-edd4-329c-b076-c0cb0e7a4edf","product":{"name":"govulncheck-vulndb-0:0.0.20251023T162509-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"3eaccb41-d5a0-38bb-9ffa-a3e18cd974ea","product":{"name":"govulncheck-vulndb-0:0.0.20251023T162509-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"658b52d1-a796-306a-b8e7-8640d2ef8e6d","product":{"name":"govulncheck-vulndb-0:0.0.20251023T162509-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"9538f7bb-6172-3cbb-b4a8-c4cbbfca24bf","product":{"name":"govulncheck-vulndb-0.0.20251023T162509-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"9c9b6bb2-f20d-3972-a86a-61769cb59d45","product":{"name":"govulncheck-vulndb-0:0.0.20251023T162509-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"a2b98c10-dc2c-32be-b9b7-261dd67e0ecc","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"a600f628-d077-3294-b4cd-d19262b4fd4b","product":{"name":"govulncheck-vulndb-0.0.20251023T162509-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"fde27079-09c4-3706-80b4-6c26309d3cdc","product":{"name":"govulncheck-vulndb-0.0.20251023T162509-1.1.s390x","vendor":{"name":"SUSE"}}}]}}]}