Besu has published four security notices covering five vulnerabilities that CertiK identified and reported. The issues were fixed in Besu 26.7.1, released on July 27, and the technical details were made public on August 14. The bugs affected block announcement handling, caching for future block height consensus proposals, WebSocket subscription limits, and unbounded JSON-RPC filter creation. Besu said the flaws could, under specific configurations, let an attacker keep consuming memory or thread resources and affect node availability or consensus processing. CertiK found the issues through its Chain Scan adversarial research on a private multi-node Besu test network, submitted the vulnerabilities with reproducible proof-of-concept test frameworks, and coordinated confidentially with Besu before the fix was released. Besu thanked CertiK and EF Security in the release notes for responsible disclosure.
Besu has issued four security advisories covering five vulnerabilities identified by CertiK, with all of the issues fixed in Besu 26.7.1, which was released on July 27. Technical details were published on August 14.
The vulnerabilities involved block announcement handling, caching for future block height consensus proposals, WebSocket subscription limits, and the creation of JSON-RPC filters without an upper bound.
Under specific configurations, an attacker could use the flaws to keep consuming node memory or thread resources, affecting node availability or consensus processing.
CertiK found the issues during its Chain Scan adversarial research, which was based on a private multi-node Besu test network and was not tied to any client mandate or commercial project.
CertiK later submitted all of the vulnerabilities to Besu, along with reproducible proof-of-concept test frameworks, and coordinated confidentially with the team before the fixed version was released.
Besu’s release notes thanked CertiK and EF Security for responsible disclosure.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
