-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0183
============================================================

Advisory-ID:  0xCERT-2026-0183
Severity:     High
Published:    2026-09-28T20:38:28.000Z
Updated:      2026-10-08T22:46:39.277Z
Chains:       Ethereum
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0183

Title: Besu 26.9.0: security release for Ethereum node operators

Summary
- -------
Besu 26.9.0 (released 2026-09-28) includes security fixes according to its release notes. Ethereum node operators running Besu should review and upgrade.

Details
- -------
Summary
Besu 26.9.0 (released 2026-09-28) includes security fixes according to its release notes. Ethereum node operators running Besu should review and upgrade.

Affected
- - Besu (hyperledger/besu) versions before 26.9.0

From the release notes
Amsterdam scheduled on Sepolia — Tue 6 Oct 2026, 13:53:36 UTC (timestamp 1791294816). Sepolia operators must upgrade before then.
This release contains security fixes. Operators are advised to upgrade promptly.
Details will be published in security advisories on
https://github.com/besu-eth/besu/security/advisories after operators have had an
opportunity to upgrade.
## Breaking Changes
- - BlockSimulationParameter.Builder.enforceConsensusGasLimitCaps() is renamed to enforceConsensusGasLimit(). The flag now also controls whether the EIP-1559 gas limit adjustment algorithm is applied: when true (plugin/block-production path) getNextGasLimit() is used; when false (default, eth_simulateV1 path) the parent gas limit is inherited unchanged, matching geth and Nethermind. #11254
- - BlockResult constructor signatures no longer accept a totalDifficulty parameter. The field was already ignored (

Recommended actions
- - Upgrade Besu to 26.9.0 or later
- - Check the release notes for any coordinated upgrade deadline or required configuration change

Source & attribution
This 0xCERT advisory relays the Besu 26.9.0 release notes: https://github.com/besu-eth/besu/releases/tag/26.9.0. Refer to the upstream project for the authoritative record and any follow-up security advisories.

References
- ----------
- - https://github.com/besu-eth/besu/releases/tag/26.9.0

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrIRlAJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmeF1hOSg2B8iOkPeHdTydRR00Ey9yfDJQoEM8Yo
Hun8TBYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAADazQEAmOKyi8hjh0fliHEU
8JvKh9sI9nQqwstpHmSnNliAF0QBAPx/ulN39xSP78W2tg4Ym8S2CNV/7VKc
h+4vJqPkIJEG
=R3jS
-----END PGP SIGNATURE-----