CVE-2025-59941: go-f3 Vulnerable to Cached Justification Verification Bypass
(updated )
A vulnerability exists in go-f3’s justification verification caching mechanism where verification results are cached without properly considering the context of the message. An attacker can bypass justification verification by:
- First submitting a valid message with a correct justification
- Then reusing the same cached justification in contexts where it would normally be invalid
This occurs because the cached verification does not properly validate the relationship between the justification and the specific message context it’s being used with.
References
Code Behaviors & Features
Detect and mitigate CVE-2025-59941 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →