Besu Fixes Five Vulnerabilities with Security Update

Besu, an open-source Ethereum execution client, has released a security update that addresses five vulnerabilities identified by CertiK. The vulnerabilities, ranging from Minor to Major severity, could exhaust node memory or thread capacity, affecting node availability and consensus processing.

The update introduces configurable limits for active JSON-RPC filters, filter timeouts, and WebSocket subscriptions, which were among the affected areas. Besu published four security advisories urging operators to upgrade to version 26.7.1, released on July 27. The vulnerabilities were identified through CertiK's independent research using its Chain Scan adversarial-testing methodology.

The 26.7.1 release also added new controls related to block-announcement processing and future-height consensus proposal buffering. Besu credits CertiK and EF Security for responsible disclosures in the release notes. The updated version remains the patched release for the identified vulnerabilities, strengthening crypto infrastructure resilience and lowering operational risk for Ethereum nodes and DeFi applications.