Besu Patches Five Security Flaws Discovered by CertiK

Kucoin

Besu Patches Five Security Flaws Discovered by CertiK

First seen 22 Aug 2026, 10:17 UTC • •45.9

Article Content

1 / 4

Browse articles

ThreatCluster •August 23, 2026 at 10:16 UTC

•Besu patched five vulnerabilities identified by CertiK in version 26.7.1.
•The vulnerabilities could exhaust node resources, affecting availability and consensus.
•Operators are advised to upgrade to the patched version to mitigate risks.

Ethereum client Besu released version 26.7.1 on July 27, 2026, to address five vulnerabilities identified by CertiK. The flaws, which ranged from Minor to Major severity, could lead to unbounded memory or thread consumption, impacting node availability and consensus processing. Technical advisories detailing these vulnerabilities were published on August 14, allowing operators to upgrade before public disclosure. The vulnerabilities were found through CertiK's Chain Scan adversarial-testing methodology on a private multi-node testnet. Key remediations included limits on active JSON-RPC filters and WebSocket subscriptions. Node operators are urged to upgrade to version 26.7.1 or later to mitigate these risks. Besu is an open-source Ethereum client used across various networks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 50d ago How this analysis works

Timeline

2026-07-27

Besu version 26.7.1 released

Besu released a security-focused update fixing five vulnerabilities identified by CertiK.

2026-08-14

Technical advisories published

Besu published detailed advisories on the vulnerabilities, allowing operators to upgrade before public disclosure.

2026-08-22

Articles published on vulnerability disclosure

Both Kucoin and Cryptorank reported on the vulnerabilities and the importance of upgrading to version 26.7.1.

More articles in this cluster (3)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Organization (3)

CertiK
EF Security
Ethereum

Weakness (1)

CWE-400 - Uncontrolled Resource Consumption

Affected Platform (1)

Besu

Relationships

Besu related to CertiK
Besu related to EF Security
Besu related to Ethereum
Besu related to CWE-400 - Uncontrolled Resource Consumption

Following this threat?

Track CertiK in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…