https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 21:45:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-253807 EUVD-2026-253807 https://cve.radiocsirt.org/vuln/euvd-2026-253807 https://cve.radiocsirt.org/vuln/fkie_cve-2025-59942 <p>go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.6 and below, go-f3 panics when it validates a &#34;poison&#34; messages causing Filecoin nodes consuming F3 messages to become vulnerable. A &#34;poison&#34; message can can cause integer overflow in the signer index validation, which can cause the whole node to crash. These malicious messages aren&#39;t self-propagating since the bug is in the validator. An attacker needs to directly send the message to all targets. This issue is fixed in version 0.8.7.</p> <p>go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.6 and below, go-f3 panics when it validates a &#34;poison&#34; messages causing Filecoin nodes consuming F3 messages to become vulnerable. A &#34;poison&#34; message can can cause integer overflow in the signer index validation, which can cause the whole node to crash. These malicious messages aren&#39;t self-propagating since the bug is in the validator. An attacker needs to directly send the message to all targets. This issue is fixed in version 0.8.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-59942 https://cve.radiocsirt.org/vuln/ghsa-g99p-47x7-mq88 <p><strong>Affected:</strong> Go: github.com/filecoin-project/go-f3</p> <p>### Impact</p> <p>Filecoin nodes consuming F3 messages are vulnerable. go-f3 panics when it validates a &#34;poison&#34; messages. A &#34;poison&#34; message can can cause integer overflow in the signer index validation. In Lotus&#39; case, the whole node will crash.</p> <p>There is no barrier to entry. An attacker doesn&#39;t need any power to pull off this attack.</p> <p>These malicious messages aren&#39;t self-propagating since the bug is in the validator. An attacker needs to directly send the message to all targets.</p> <p>### Patches The fix was merged and released with go-f3 0.8.7. All node software (Lotus, Forest, Venus) are using a patched version of go-f3 with their updates for the nv27 network upgrade.</p> <p>go-f3 now does proper overflow checking using `math.MaxInt64` comparison and returns error `&#34;justificationPower overflow&#34;` when overflow would occur.</p> <p>### Workarounds The are no immediate workarounds available. Nodes should upgrade to the patched version, which they will have done if participating in nv27 on Filecoin mainnet.</p> <p>### Credits The initial finding(unrelated path) was reported by [0xNirix](https://github.com/0xNirix) via bug bounty program which wasn&#39;t high issue. The further digging by developers led to this finding. Thank you for the contributions.</p> <p><strong>Affected:</strong> Go: github.com/filecoin-project/go-f3</p> <p>### Impact</p> <p>Filecoin nodes consuming F3 messages are vulnerable. go-f3 panics when it validates a &#34;poison&#34; messages. A &#34;poison&#34; message can can cause integer overflow in the signer index validation. In Lotus&#39; case, the whole node will crash.</p> <p>There is no barrier to entry. An attacker doesn&#39;t need any power to pull off this attack.</p> <p>These malicious messages aren&#39;t self-propagating since the bug is in the validator. An attacker needs to directly send the message to all targets.</p> <p>### Patches The fix was merged and released with go-f3 0.8.7. All node software (Lotus, Forest, Venus) are using a patched version of go-f3 with their updates for the nv27 network upgrade.</p> <p>go-f3 now does proper overflow checking using `math.MaxInt64` comparison and returns error `&#34;justificationPower overflow&#34;` when overflow would occur.</p> <p>### Workarounds The are no immediate workarounds available. Nodes should upgrade to the patched version, which they will have done if participating in nv27 on Filecoin mainnet.</p> <p>### Credits The initial finding(unrelated path) was reported by [0xNirix](https://github.com/0xNirix) via bug bounty program which wasn&#39;t high issue. The further digging by developers led to this finding. Thank you for the contributions.</p> https://cve.radiocsirt.org/vuln/ghsa-g99p-47x7-mq88 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15666-1 <p>govulncheck-vulndb-0.0.20251023T162509-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20251023T162509-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15666-1