How CertiK Found Five Vulnerabilities in Besu and Got Them Fixed in a Fortnight
CertiK reported five resource exhaustion bugs to the Besu maintainers who shipped the fixes within a fortnight and then published severity ratings that disagree
CertiK discovered five vulnerabilities in the Besu client within a short span, and the developers promptly addressed them in the version 26.7.1 release. These issues, rated from minor to major, affect various interfaces such as devp2p, eth/68, istanbul/100, and WebSocket RPC. The first, HYB-01, is a high-severity issue that allows an attacker to flood the client with block fetch requests, consuming memory and threads.
The second, HYB-02, involves a flaw in the BFT event processor heap, which could be exploited via an Istanbul/100 subprotocol. The third, HYB-03, involves the WebSocket RPC Subscription manager, while HYB-04 deals with the retrieval of unknown parent blocks. Lastly, HYB-08 is a minor issue related to memory consumption in the HTTP JSON-RPC filter repository.
The vulnerabilities highlight the importance of maintaining multiple client implementations within the Ethereum ecosystem to ensure network availability and security.
Written by urgent.news from HackerNoon's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
