ShippethEthereum releases, writing, news and network upgrades
Everything90Releases35Articles17Advisories38

Security advisories of the clients, exploited vulnerabilities in the software and hardware node operators run, and incidents at certificate authorities.

Network upgradeNothing scheduled. Glamsterdam is on devnet 11

Security advisories and exploited vulnerabilities

Showing only Besu. Show everything
An enterprise-grade Java-based, Apache 2.0 licensed Ethereum client https://github.com/besu-eth/besu/wikibesu-eth/besu on GitHub

38 items match, 21 of them low signal.

The stream

Newest first
Wed 14 October
EIP-7702 and sender signature recovery skips the secp256k1 curve-order bound, so native and BouncyCastle backends recover different authorities (consensus split) (opens in a new tab) · Besu Security High
Tue 13 October
QBFT/IBFT2 message decode performs unbounded eager signature recovery before the validator check, letting any peer stall the consensus thread (DoS) (opens in a new tab) · Besu Security High
Thu 8 October
A permissionless non-validator peer can halt QBFT finality through pre-authorization proposal decoding (opens in a new tab) · Besu Security High
Fri 2 October
Bonsai parallel block processor retains transaction futures after block rejection, causing unbounded memory growth and node outage (opens in a new tab) · Besu Security High
Fri 2 October
Pre-authentication discovery-packet handling flaw allows remote unauthenticated log-amplification denial of service (discv4 UDP). (opens in a new tab) · Besu Security Medium
Fri 2 October
`eth_getLogs` enforces an `--rpc-max-logs-range` block-range cap, but the same protection is missing from the filter-based path. An unauthenticated caller can install a filter via `eth_newFilter` with `fromBlock: "0x0", toBlock: "latest"`, then poll (opens in a new tab) · Besu Security High
Fri 2 October
Besu's DiscV4 UDP discovery remote DoS (opens in a new tab) · Besu Security High
Sat 26 September
JWT algorithm confusion allows token forgery when HMAC algorithm is used with a public key file (opens in a new tab) · Besu Security High
Sat 26 September
Engine API JWT secret exposed in application logs when ephemeral key file cannot be written (opens in a new tab) · Besu Security High
Sat 26 September
Log filter and subscription address lists are unbounded and matched linearly on the block-import thread, allowing unauthenticated callers to stall block production (opens in a new tab) · Besu Security High
Sat 26 September
Shanghai-enabled QBFT lets one Byzantine validator mint native currency through unvalidated withdrawals (opens in a new tab) · Besu Security High
Fri 14 August
A single devp2p peer can drive unbounded block-fetch work via repeated NEW_BLOCK_HASHES/NEW_BLOCK announcements for the same block number (opens in a new tab) · Besu Security High
Fri 14 August
Per-transaction O(N^2) HashDoS via hash-bucket collisions in EVM warm-access and EIP-1153 transient-storage tracking (opens in a new tab) · Besu Security High
Fri 14 August
MainnetTransactionProcessor applies SELFDESTRUCT markers from the initial frame even when the transaction fails, leaking account deletion past EIP-6780 semantics (opens in a new tab) · Besu Security High
Mon 10 August
`CodeDelegationTransactionDecoder.decodeInnerPayload` reads the per-authorisation `chainId` as an unbounded `BigInteger`, but `MainnetTransactionValidator.validateTransactionType` enforces `chainId < 2^256` by **throwing an unchecked `IllegalArgument (opens in a new tab) · Besu Security High
Fri, 23 September 2022
Gas allocation error in CALL operations in Besu EVM (opens in a new tab) · Besu Security Critical CVE-2022-36025
Fri, 10 December 2021
SHL, SHR, and SAR operations trigger native exception at key values (opens in a new tab) · Besu Security High CVE-2021-41272

Also collected

Per-package monorepo tags, releases that carry little weight, and publications that post several times a day
QBFT/IBFT validator forgets its prepared certificate when the round advances by any route other than its own timer, weakening the quorum-intersection argument (opens in a new tab) · Besu Security Medium
Besu accepts RLP-wrapped typed transactions in ExecutionPayload block bodies, causing a client-line consensus split (opens in a new tab) · Besu Security Medium
debug_traceTransaction and trace_* RPC methods missing server-side EVM step cap — incomplete fix for GHSA-4776-8c3f-fx7g (opens in a new tab) · Besu Security Medium