Ethereum Client Besu Patches Five Vulnerabilities Reported by CertiK

By Lidia Yadlos

Security researchers have disclosed five vulnerabilities affecting Besu, one of Ethereum's most widely used execution clients, after the issues were patched through a coordinated disclosure process.

The vulnerabilities, identified by CertiK, were addressed in Besu version 26.7.1, released on July 27. Technical details remained confidential until August 14, when Besu published four security advisories documenting the fixes after giving node operators time to upgrade.

The coordinated approach followed established responsible disclosure practices, allowing patches to be deployed before details of the vulnerabilities became public.

Five Security Issues Across Core Services

According to CertiK, the vulnerabilities were uncovered during independent security research using the company's Chain Scan adversarial testing methodology rather than through a commercial audit.

Researchers built a private multi-node Besu network and introduced controlled faults across peer-to-peer networking, HTTP JSON-RPC, WebSocket RPC and consensus interfaces to identify areas where nodes could become unavailable or consume excessive resources.

The findings, rated by CertiK from Minor to Major in severity, involved block-announcement processing, future-height consensus proposal buffering, WebSocket subscription limits, and uncapped JSON-RPC filter creation.

Under certain configurations, the vulnerabilities could allow attackers to exhaust node memory or thread capacity, disrupting node availability or interfering with consensus processing.

CertiK reported each issue privately to the Besu development team and supplied proof-of-concept test environments that reproduced the vulnerabilities.

The teams worked together while Besu evaluated and patched the issues, with technical details withheld until version26.7.1 had been available long enough for operators to upgrade.

Besu acknowledged both CertiK and the Ethereum Foundation Security Team in its release notes for their responsible disclosures.

Why Ethereum Clients Matter

Execution clients like Besu form part of Ethereum's core infrastructure. Rather than interacting directly with smart contracts or decentralized applications, they validate transactions, execute blocks and communicate with other nodes across the network.

A vulnerability affecting a widely deployed client can therefore have consequences far beyond a single application.

Ethereum intentionally supports multiple independent execution clients—including Besu, Geth, Nethermind and Erigon—to reduce systemic risk and improve network resilience. Discovering and fixing vulnerabilities before they are exploited is an important part of maintaining that diversity.

Security Before Exploitation

The disclosure highlights how much of Web3 security happens before users ever become aware of a threat.

According to CertiK, the research was entirely self-directed and not commissioned by Besu or any commercial client. The company says it has identified more than 119,000 vulnerabilities across Web3 projects since its founding and has helped protect over $600 billion in digital assets worldwide.

In this case, the vulnerabilities were patched before technical details became public, allowing node operators to secure their infrastructure without exposing the broader Ethereum ecosystem to unnecessary risk.

For blockchain infrastructure providers, that remains the goal of responsible disclosure: finding weaknesses before attackers do.

Published on Ethereum

Ethereum Client Besu Patches Five Vulnerabilities Reported by CertiK