{
  "id": 2404879,
  "title": "How CertiK Found Five Vulnerabilities in Besu and Got Them Fixed in a Fortnight",
  "url": "https://urgent.news/2026/08/21/how-certik-found-five-vulnerabilities-in-besu-and-got-them-fixed-in-a",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-21T15:06:40.000Z",
  "source": {
    "name": "HackerNoon",
    "slug": "hackernoon",
    "url": "https://hackernoon.com/how-certik-found-five-vulnerabilities-in-besu-and-got-them-fixed-in-a-fortnight?source=rss"
  },
  "original_language": "en",
  "account": "CertiK discovered five vulnerabilities in the Besu client within a short span, and the developers promptly addressed them in the version 26.7.1 release. These issues, rated from minor to major, affect various interfaces such as devp2p, eth/68, istanbul/100, and WebSocket RPC. The first, HYB-01, is a high-severity issue that allows an attacker to flood the client with block fetch requests, consuming memory and threads. The second, HYB-02, involves a flaw in the BFT event processor heap, which could be exploited via an Istanbul/100 subprotocol. The third, HYB-03, involves the WebSocket RPC Subscription manager, while HYB-04 deals with the retrieval of unknown parent blocks. Lastly, HYB-08 is a minor issue related to memory consumption in the HTTP JSON-RPC filter repository. The vulnerabilities highlight the importance of maintaining multiple client implementations within the Ethereum ecosystem to ensure network availability and security.",
  "summary": "CertiK reported five resource exhaustion bugs to the Besu maintainers who shipped the fixes within a fortnight and then published severity ratings that disagree",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}