Headline: Besu patches five CertiK-discovered vulnerabilities in v26.7.1 — operators urged to upgrade Hyperledger Besu has fixed five security flaws reported by CertiK and bundled the patches into release 26.7.1, which was published on July 27. Besu made technical advisories public on August 14, confirming the vulnerabilities affected peer-to-peer, RPC (HTTP and WebSocket) and consensus-facing interfaces of the Java-based Ethereum client. Operators are being urged to upgrade to the patched release. What happened - CertiK discovered the issues during self-directed research using its Chain Scan adversarial-testing methodology on a private, multi-node Besu test network. Researchers introduced controlled faults across P2P, HTTP RPC, WebSocket RPC and consensus-facing interfaces to assess availability and resource-exhaustion risks. - The findings were reported privately to the Besu team with reproducible proof-of-concept test harnesses. Besu released 26.7.1 as a security update on July 27 and publicly published detailed advisories on August 14, following a coordinated responsible-disclosure timeline that allowed operators to patch before technical specifics were exposed. Impact and severity - The vulnerabilities — rated by CertiK from Minor to Major — could allow resource exhaustion (memory or threads) under affected configurations. That pressure could disrupt node availability or interfere with consensus processing. - Affected subsystems included block-announcement handling, buffering of future-height consensus proposals, WebSocket subscription handling, and JSON-RPC filter creation without effective caps. Remediations in v26.7.1 - Besu’s 26.7.1 release closes the reported attack paths. Notable mitigations include new limits on active JSON-RPC filters and WebSocket subscriptions to prevent unbounded resource growth. - The release notes on GitHub identify 26.7.1 as a security-focused update and credit CertiK and EF Security for responsible disclosure. Context on Besu and CertiK - Besu is an open-source, Java-based Ethereum client (Apache 2.0) supporting public mainnet, testnets and enterprise private networks. It offers CLI, JSON-RPC and Plugin APIs for node operations and extensions. - CertiK, founded in 2017 by academics from Yale and Columbia, says it has identified more than 119,000 vulnerabilities and protected over $600 billion in assets globally. Takeaway - Because the fixes were available before the vulnerabilities were published, operators had an opportunity to upgrade with reduced exposure. Besu continues to recommend that node operators move to v26.7.1 (or later) to mitigate these issues. Note: This article is informational. Users should do their own research before taking action. Read more AI-generated news on: undefined/news