Teku and Besu release security updates to fix the eMudhra certificate vulnerability
BIBIBI
AT A GLANCE
Teku and Besu released updates that stop trusting certificates associated with eMudhra.
Article
Ethereum clients Teku and Besu fix certificate vulnerability to prevent attackers from stealing ETH Rewards
PANews October 29 reported, according to CoinDesk, that the Ethereum client Teku released 26.10.3, while Besu released 26.10.2; both stopped trusting certificates related to the Indian certificate authority eMudhra in their Docker images. Researchers had previously found that, due to a cryptographic flaw, the private keys of eMudhra's eight intermediate certificate authorities could be calculated. Teku said that if an attacker were located between a validator and the service to which it connects, they could impersonate that service. A deceived validator might propose a block that pays fees to the attacker's address, with the risk of forged external signers being the highest. Teku said default mainnet nodes are unaffected, and no exploitation has been reported. Operators running the software directly without Docker must update Java themselves; users still using Java 26 must migrate to Java 25, which is no longer maintained.
Teku released 26.10.3, while Besu released 26.10.2.
02
Both versions cease trusting eMudhra-related certificates in Docker images.
03
Researchers found that the private keys of intermediate certificate authorities at eMudhra could be derived.
04
Teku stated that an attacker could impersonate a service to which validators connect and induce them to submit blocks that pay fees to the attacker’s address.
05
Teku stated that default mainnet nodes are not affected and that no exploitation has been reported.
06
Operators running directly without Docker must update Java themselves; users of Java 26 must migrate to Java 25。
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
Certificates are used to verify whether connected services are trustworthy. This update removes trust in the relevant certificates to reduce the risk of service impersonation.
Why it matters to readers
If a validator connects to an impersonated service, the address receiving block reward fees could be altered; operators need to check their client, Docker, and Java configurations.
Ordinary users typically need take no action; users operating validators, external signers, or related nodes should note the version and Java update requirements.
Risks and unknowns
The evidence is based on a report attributed to CoinDesk and does not provide the original official announcements from Teku or Besu.
The evidence does not specify the full scope of affected deployments or report any actual financial losses that have occurred.
The evidence does not elaborate on specific remediation steps for directly operated non-Docker environments.
Related Developments
Loading event timeline…
Related concepts
validators
This term is not in the glossary yet. Browse related concepts in the glossary.
