Besu patches five vulnerabilities in urgent 26.7.1 release

Besu released version 26.7.1 on July 27 to remediate five security vulnerabilities and flagged the update as urgent. Detailed advisories for the issues were published on Aug. 14 after an intentional delay meant to give node operators time to upgrade before technical details were made public.

Blockchain security firm Certik discovered the flaws using its Chain Scan adversarial-testing method on a private multi-node network. Researchers injected controlled faults across peer-to-peer connections, HTTP JSON-RPC, WebSocket RPC, and consensus-facing interfaces to observe how nodes handled malformed or stress-inducing behavior. Certik rated the findings from minor to major and provided Besu maintainers with reproducible proof-of-concept test harnesses.

The vulnerabilities affected block-announcement processing, buffering of consensus proposals with future heights, WebSocket subscription limits, and JSON-RPC filter creation. If left unpatched, the flaws could allow an attacker to exhaust a node’s memory or thread capacity, degrading node availability and delaying or disrupting consensus processing.

Besu acknowledged Certik and Ethereum Foundation Security in its release notes and published upgrade instructions with the release. Jialiang Chang, director of security engineering at Certik, described the “patch-first, details-later” sequencing as effective: “The effectiveness comes from the sequencing, rather than from delaying disclosure for its own sake.” He said the 18-day gap between the patch and the advisories gave operators time to identify affected deployments, test the update in staging, coordinate upgrades across validators or consortium participants, and prepare rollback and monitoring procedures.

Certik is expanding Chain Scan to run continuous multi-node adversarial testing across public blockchain networks. Chang noted that testing coverage remains uneven for issues such as resource exhaustion, asynchronous race conditions, malicious peer behavior, long-duration degradation and deployment-specific failures. He recommended a layered testing approach that combines maintainer continuous integration and fuzzing, multi-node adversarial testing, periodic independent research, and the addition of a regression test or attack scenario for each confirmed vulnerability.

Node operators and validator operators running Besu are the primary audience for the fixes and guidance and should follow the upgrade instructions provided in the 26.7.1 release.