Ethereum clients Teku and Besu release security patches

Ethereum client developers Teku and Besu have released security updates to address a certificate vulnerability that could allow attackers to impersonate services used by validators. The flaw originated from a compromise involving weak cryptographic keys associated with eight certificate authorities operated by the Indian company eMudhra.

If exploited, the vulnerability could allow an attacker to intercept HTTPS connections and potentially redirect validator block rewards or manipulate block proposals. Teku reported that default mainnet configurations without HTTPS URLs are unaffected, and there have been no reports of exploitation to date.

The updates, Teku version 26.10.3 and Besu version 26.10.2, address the issue by removing trust for the implicated eMudhra certificate roots from their Docker images. However, operators using standalone binary installations must manually update their separately managed Java runtimes, as Java does not check certificate revocation by default.