-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0258
============================================================

Advisory-ID:  0xCERT-2026-0258
Severity:     Medium
Published:    2026-10-20T07:49:47.000Z
Updated:      2026-10-20T08:08:04.657Z
Chains:       Ethereum
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0258

Title: Erigon v3.8.0: security release for Ethereum node operators

Summary
- -------
Erigon v3.8.0 (released 2026-10-20) includes security fixes according to its release notes. Ethereum node operators running Erigon should review and upgrade.

Details
- -------
Summary
Erigon v3.8.0 (released 2026-10-20) includes security fixes according to its release notes. Ethereum node operators running Erigon should review and upgrade.

Affected
- - Erigon (erigontech/erigon) versions before v3.8.0

From the release notes
mn storage. Leave
- --caplin.columns-keep-slots at 0 to follow this window; an explicit value overrides pruning
retention and may delete columns the node still needs to serve (#24720) — by @Bruce039
## Security
- - Network decoders allocate buffers as data arrives and reject impossible compressed sizes. Tighter
bounds on peer queues, transaction packets, and Caplin gossip control messages reduce memory
exhaustion risks from hostile traffic (#24374, #24649, #24648, #24392, #24508, #24616) — by
@yperbasis, @AskAlexSharov
- - RPC rejects oversized transactions before decoding. Caplin bounds SSZ committee vectors and
rejects invalid validator and slashing indices, preventing excessive allocations and panics.
Invalid block access list indices are rejected before execution. The Engine API rejects null
withdrawal entries before hashing or building blocks
(#24315, #24614, #24615, #24771, #

Recommended actions
- - Upgrade Erigon to v3.8.0 or later
- - Check the release notes for any coordinated upgrade deadline or required configuration change

Source & attribution
This 0xCERT advisory relays the Erigon v3.8.0 release notes: https://github.com/erigontech/erigon/releases/tag/v3.8.0. Refer to the upstream project for the authoritative record and any follow-up security advisories.

References
- ----------
- - https://github.com/erigontech/erigon/releases/tag/v3.8.0

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrYAMAJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmeD7eX+3ZpeC9r1t/fbRc7tmqr5WGXdbLUYv7bI
NuPqvxYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAB2AwEAlzpWTiAyo3H5AIMl
fazcBkZWeVMjXUX7aysvzAniprkBAPeAX5hKlPpsWzZRc0awSgCv2FaFLGA/
L7/i5PnZ+mIG
=urZf
-----END PGP SIGNATURE-----