Besu Releases Version 26.7.1 to Patch Security Vulnerabilities

Besu Addresses Security Vulnerabilities in Version 26.7.1

Besu has announced the release of version 26.7.1 to tackle five security vulnerabilities identified by CertiK. The update, which was initially made available on July 27, aimed to strengthen the Java-based Ethereum client’s security across various interfaces.

Details of the Vulnerabilities

The vulnerabilities highlighted by CertiK during independent research posed resource-exhaustion risks that could affect networking, RPC, WebSocket, and consensus interfaces. These flaws had the potential to disrupt node availability and consensus processing under specific configurations.

Patch Release and Security Advisories

Following a coordinated disclosure process with CertiK, Besu worked to address the identified vulnerabilities prior to public disclosure. On August 14, Besu shared detailed advisories concerning the vulnerabilities, which it had successfully patched in the latest release. This timing allowed users to update their systems before the specifics of the flaws were made widely known.

Findings from CertiK’s Research

CertiK’s findings, rated from Minor to Major in severity, included issues with block-announcement processing and limitations on WebSocket subscriptions and JSON-RPC filters. The independent testing by CertiK, conducted on a private multi-node network, revealed faults that could lead to memory and thread exhaustion, ultimately affecting node performance.

Emphasizing Security Upgrades

Besu recommended that all operators upgrade to version 26.7.1 immediately in light of these vulnerabilities. The update included important remediations such as limits on active JSON-RPC filters and WebSocket subscriptions, addressing the paths for unbounded resource growth.

Commitment to Security and Transparency

With the release of the advisory, Besu has established a transparent record of the vulnerabilities along with their resolutions. The project acknowledges the collaborative efforts of CertiK and EF Security for their responsible reporting and disclosure protocols.

Besu, which is supported under the Apache 2.0 license, is an open-source Ethereum client that serves both public and private network uses. Companies integrating this technology are encouraged to stay vigilant and up-to-date with security practices to protect their assets.