ShippethEthereum releases, writing, news and network upgrades
Everything376Releases227Articles94Advisories55

Security advisories of the clients, exploited vulnerabilities in the software and hardware node operators run, and incidents at certificate authorities.

Network upgradeNothing scheduled. Glamsterdam is on devnet 11

Security advisories and exploited vulnerabilities

Protocol. The chain itself: specifications, forks, clients, node software.

55 items match, 28 of them low signal.

The stream

Newest first
Wed 14 October
EIP-7702 and sender signature recovery skips the secp256k1 curve-order bound, so native and BouncyCastle backends recover different authorities (consensus split) (opens in a new tab) · Besu Security High
Tue 13 October
QBFT/IBFT2 message decode performs unbounded eager signature recovery before the validator check, letting any peer stall the consensus thread (DoS) (opens in a new tab) · Besu Security High
Thu 8 October
A permissionless non-validator peer can halt QBFT finality through pre-authorization proposal decoding (opens in a new tab) · Besu Security High
Fri 2 October
Bonsai parallel block processor retains transaction futures after block rejection, causing unbounded memory growth and node outage (opens in a new tab) · Besu Security High
Fri 2 October
Pre-authentication discovery-packet handling flaw allows remote unauthenticated log-amplification denial of service (discv4 UDP). (opens in a new tab) · Besu Security Medium
Fri 2 October
`eth_getLogs` enforces an `--rpc-max-logs-range` block-range cap, but the same protection is missing from the filter-based path. An unauthenticated caller can install a filter via `eth_newFilter` with `fromBlock: "0x0", toBlock: "latest"`, then poll (opens in a new tab) · Besu Security High
Fri 2 October
Besu's DiscV4 UDP discovery remote DoS (opens in a new tab) · Besu Security High
Sat 26 September
JWT algorithm confusion allows token forgery when HMAC algorithm is used with a public key file (opens in a new tab) · Besu Security High
Sat 26 September
Engine API JWT secret exposed in application logs when ephemeral key file cannot be written (opens in a new tab) · Besu Security High
Sat 26 September
Log filter and subscription address lists are unbounded and matched linearly on the block-import thread, allowing unauthenticated callers to stall block production (opens in a new tab) · Besu Security High
Sat 26 September
Shanghai-enabled QBFT lets one Byzantine validator mint native currency through unvalidated withdrawals (opens in a new tab) · Besu Security High
Fri 14 August
A single devp2p peer can drive unbounded block-fetch work via repeated NEW_BLOCK_HASHES/NEW_BLOCK announcements for the same block number (opens in a new tab) · Besu Security High
Fri 14 August
Per-transaction O(N^2) HashDoS via hash-bucket collisions in EVM warm-access and EIP-1153 transient-storage tracking (opens in a new tab) · Besu Security High
Fri 14 August
MainnetTransactionProcessor applies SELFDESTRUCT markers from the initial frame even when the transaction fails, leaking account deletion past EIP-6780 semantics (opens in a new tab) · Besu Security High
Mon 10 August
`CodeDelegationTransactionDecoder.decodeInnerPayload` reads the per-authorisation `chainId` as an unbounded `BigInteger`, but `MainnetTransactionValidator.validateTransactionType` enforces `chainId < 2^256` by **throwing an unchecked `IllegalArgument (opens in a new tab) · Besu Security High
Tue 17 February
DoS via malicious p2p message (opens in a new tab) · Go Ethereum Security High CVE-2026-26314
Tue 13 January
DoS via malicious p2p message (opens in a new tab) · Go Ethereum Security High CVE-2026-22862
Thu, 30 January 2025
DoS via malicious p2p message (opens in a new tab) · Go Ethereum Security High CVE-2025-24883
Mon, 6 May 2024
DoS via malicious p2p message (opens in a new tab) · Go Ethereum Security High CVE-2024-32972
Wed, 6 September 2023
DoS via malicious p2p message (opens in a new tab) · Go Ethereum Security High CVE-2023-40591
Fri, 23 September 2022
Gas allocation error in CALL operations in Besu EVM (opens in a new tab) · Besu Security Critical CVE-2022-36025
Fri, 10 December 2021
SHL, SHR, and SAR operations trigger native exception at key values (opens in a new tab) · Besu Security High CVE-2021-41272
Tue, 24 August 2021
RETURNDATA corruption via datacopy (opens in a new tab) · Go Ethereum Security High CVE-2021-39137
Fri, 11 December 2020
Consensus flaw during block processing (opens in a new tab) · Go Ethereum Security High CVE-2020-26265
Tue, 24 November 2020
Denial of service via `MulMod` (opens in a new tab) · Go Ethereum Security High CVE-2020-26242
Tue, 24 November 2020
Denial of service due to Go CVE-2020-28362 (opens in a new tab) · Go Ethereum Security Critical CVE-2020-28362
Tue, 24 November 2020
Shallow copy in the 0x4 precompile could lead to EVM memory corruption (opens in a new tab) · Go Ethereum Security High CVE-2020-26241

Also collected

Per-package monorepo tags, releases that carry little weight, and publications that post several times a day
QBFT/IBFT validator forgets its prepared certificate when the round advances by any route other than its own timer, weakening the quorum-intersection argument (opens in a new tab) · Besu Security Medium
Besu accepts RLP-wrapped typed transactions in ExecutionPayload block bodies, causing a client-line consensus split (opens in a new tab) · Besu Security Medium
debug_traceTransaction and trace_* RPC methods missing server-side EVM step cap — incomplete fix for GHSA-4776-8c3f-fx7g (opens in a new tab) · Besu Security Medium
Improper ECIES Public Key Validation in RLPx Handshake (opens in a new tab) · Go Ethereum Security Medium CVE-2026-26315
DoS via malicious p2p message (opens in a new tab) · Go Ethereum Security Medium CVE-2026-26313
DoS via malicious p2p message (opens in a new tab) · Go Ethereum Security Medium CVE-2026-22868