Ethereum Clients Teku and Besu Address Certificate Vulnerability
Written with artificial intelligence.
Ethereum clients Teku and Besu have released updates to mitigate a cryptographic vulnerability related to eMudhra, an Indian certificate authority. Users running these clients in Docker need to ensure they are using the latest versions to prevent potential exploitation.
Overview of the Vulnerability
On October 29, PANews reported that Ethereum clients Teku and Besu released versions 26.10.3 and 26.10.2, respectively. These updates stop trusting certificates associated with the Indian certificate authority eMudhra in their Docker images due to a discovered cryptographic flaw.
Potential Risks
Research indicated that the private keys of eight intermediate certificate authorities from eMudhra could be derived due to this vulnerability. Teku warned that attackers positioned between a validator and its connected service could impersonate that service. This could lead to manipulated validators submitting blocks that direct fees to the attacker's address, with the highest risk related to forged external signers.
Impact on Users
Teku confirmed that the default nodes on the mainnet are unaffected and there have been no reported exploitations. However, operators running Teku or Besu outside of Docker need to manually update their Java versions. Users still on Java 26 are advised to migrate to Java 25, which is no longer maintained.