According to reports from crypto.news, CertiK discovered five security vulnerabilities in Besu during independent security research. The vulnerabilities were found through self-directed testing on a private, multi-node Besu network using CertiK's Chain Scan adversarial-testing methodology. Researchers introduced controlled faults across peer-to-peer, HTTP RPC, WebSocket RPC, and consensus-facing interfaces to examine availability and resource-exhaustion risks under controlled conditions. As per CertiK, the research team deployed a private multi-node Besu testnet and used chaos-engineering-style fault injection harnesses, adapted from telecommunications and distributed-systems testing practices, to send adversarial inputs across all protocol surfaces and observe the results.
As reported by crypto.news, CertiK reported all five findings directly to the Besu team and supplied reproducible proof-of-concept test harnesses. The coordinated disclosure process gave Besu operators time to upgrade before detailed vulnerability information became publicly available. CertiK rated the five findings from Minor to Major in severity, with the affected areas including block-announcement processing, buffering of future-height consensus proposals, WebSocket subscription limits, and JSON-RPC filter creation without effective caps. The two teams coordinated confidentially while Besu evaluated and addressed the issues, with CertiK conducting this research independently and proactively without a client engagement.
According to crypto.news, Besu first released version 26.7.1 on July 27 as a security update and urged users to upgrade. The release addressed all five CertiK findings along with separate security issues. The release notes introduced limits affecting JSON-RPC filters and WebSocket subscriptions, closing paths for unbounded resource growth. Besu replaced the unbounded thread pool backing the NEW_BLOCK_HASHES message handling with a fixed-size, bounded pool, throttling floods instead of letting them spawn threads without limit. The release also added a total-byte budget to the future-message buffer with eviction, capping it at a fixed memory ceiling regardless of message size. Besu's GitHub release page identifies 26.7.1 as a security-focused update and credits CertiK and EF Security for responsible disclosure.
As reported by crypto.news, Besu published detailed advisories on August 14 covering the five CertiK findings and their remediation. The advisories created a public record of the vulnerabilities and their resolution. The project's release notes also acknowledged CertiK and EF Security for their respective responsible disclosures. All five vulnerabilities are now patched in Besu version 26.7.1 and documented in four public GitHub Security Advisories, as two of the five findings shared the same root cause and the same fix. Besu is an open-source Ethereum client written in Java and licensed under Apache 2.0, supporting public and private network use cases.
