CertiK Uncovers Five DoS Vulnerabilities in Ethereum's Besu Client

CertiK disclosed five vulnerabilities in Hyperledger Besu, one of Ethereum's four major execution clients, all patched in version 26.7.1 released on 27 July, with detailed advisories following on 14 August. Each flaw let an unauthenticated peer exhaust a node's memory or thread capacity through devp2p, BFT consensus messaging, WebSocket subscriptions, or JSON-RPC filters, rather than any path to theft or forged blocks.

The most serious finding, rated High, exploited the eth/68 handshake to make Besu schedule unbounded block-fetch work from a single peer, with no configuration escape hatch since peering cannot be disabled on a live node. A second flaw showed that Besu's BFT message buffer capped message count but not message size, letting oversized future-height proposals exhaust a validator's heap and stall consensus.

Besu holds a minority roughly 7.5% of Ethereum's execution-layer nodes behind Geth, Nethermind and Reth, which limits blast radius but does not reduce the value of the fix: these are exactly the availability bugs that Ethereum's multi-client design is meant to contain. The 18-day gap between the silent patch release and detailed advisories reflects standard coordinated disclosure practice, giving operators time to upgrade before technical details became public.