Besu Fixes Five Security Vulnerabilities Identified by CertiK

Ethereum client Besu has released a security update to fix five vulnerabilities identified by CertiK. The issues, ranging from minor to major severity, were addressed in version 26.7.1, which was released on July 27.

The vulnerabilities could have potentially affected node availability or consensus processing under certain configurations. They involved block-announcement processing, future-height consensus proposal buffering, WebSocket subscriptions, and JSON-RPC filter creation.

Besu added new controls to prevent resource exhaustion, including a configurable maximum for active JSON-RPC filters and a limit on active WebSocket subscriptions.