Besu Fixes Five Security Vulnerabilities in Version 26.7.1

Besu, an open-source Ethereum client written in Java, has fixed five security vulnerabilities found by CertiK and patched them in version 26.7.1.

CertiK, a security firm that specializes in detecting vulnerabilities, discovered the flaws through self-directed testing on a private, multi-node Besu network. The weaknesses affected areas such as block-announcement processing, buffering of future-height consensus proposals, WebSocket subscription limits, and JSON-RPC filter creation without effective caps.

The issues posed resource-exhaustion risks across peer-to-peer, RPC, WebSocket, and consensus interfaces, which could lead to node memory or thread capacity exhaustion and disrupt node availability or consensus processing. The project team was notified privately by CertiK before the details were made public on August 14.