Hyperledger Besu has published details of five security vulnerabilities that were privately reported by CertiK and fixed in version 26.7.1 of the Ethereum client. The advisories were released on Aug. 14, several weeks after the patched version became available on July 27.

The issues affected multiple parts of the Java-based client, including peer-to-peer networking, RPC, WebSocket, and consensus-facing interfaces. In the configurations described by the project, the flaws could lead to memory or thread exhaustion, with potential disruption to node availability or consensus processing.

Patch released before advisories

Besu shipped version 26.7.1 on July 27 as a security update and at the time urged operators to upgrade. According to the project’s GitHub release page, the update addressed all five CertiK findings as well as separate security issues, and it credited both CertiK and EF Security for responsible disclosure.

The fuller technical write-up came later. On Aug. 14, Besu published four advisories covering the five vulnerabilities, with each notice identifying version 26.7.1 as the release that resolves the problems. That sequence meant the fix was available before detailed descriptions of the weaknesses were made public.

How the flaws were found

CertiK said it identified the vulnerabilities through self-directed testing on a private, multi-node Besu network. The research was described as having no commercial scope, and the findings were reported privately to the Besu team rather than disclosed immediately.

Researchers also provided reproducible proof-of-concept test harnesses so the project could review the observed behavior. Besu and CertiK then worked through a confidential remediation process and released technical details only after the patched version was already available, following a coordinated disclosure approach outlined in the source material.

Affected components and risks

The five findings were rated by CertiK from Minor to Major in severity. The problems touched several resource-sensitive areas of the client, including block announcement processing, buffering of future-height consensus proposals, WebSocket subscription limits, and JSON-RPC filter creation without effective caps.

Besu said these weaknesses, in affected configurations, could drive unbounded use of memory or available threads. Such pressure could interfere with normal node operation, including service availability and the handling of consensus-related work. The risk described in the advisories was therefore operational disruption rather than a claim of direct asset loss.

What changed in 26.7.1

Some of the remediation is visible in the 26.7.1 release notes. Besu introduced limits affecting JSON-RPC filters and WebSocket subscriptions, changes aimed at shutting down paths that could otherwise allow uncontrolled resource growth.

The project framed 26.7.1 as a security-focused release and advised operators to move to the patched version when it was published. Based on the advisories, version 26.7.1 is the confirmed release tied to the fixes for all five CertiK-reported issues.

Confirmed next step for operators

The public record in the source material points to a single clear next step: use version 26.7.1 or later in place of affected setups. Besu has already published the relevant advisories, and the project’s release notes identify the patched build.

Beyond that, the case serves as a recent example of coordinated disclosure in Ethereum infrastructure: independent testing uncovered flaws, the client team issued a fix first, and technical specifics followed once remediation was available to node operators.

Source: crypto.news