Besu 26.10.2: security release for Ethereum node operators

Summary

Besu 26.10.2 (released 2026-10-26) includes security fixes according to its release notes. Ethereum node operators running Besu should review and upgrade.

Affected

• Besu (hyperledger/besu) versions before 26.10.2

From the release notes

#11390 - eth_getLogs and GraphQL logs now enforce the --rpc-max-log-filter-addresses cap on the address list that eth_newFilter and eth_subscribe already applied, closing that bypass of the fix for GHSA-p6f8-q9mp-7mj9. A request naming more addresses than the cap is rejected before any block is read: JSON-RPC returns Filter address count exceeds limit (-32005) and GraphQL returns Invalid params. The default stays 1000 addresses; --rpc-max-log-filter-addresses=0 keeps the previous uncapped behaviour. #11667 - Debug traces with an opcode filter or a step limit report the post-execution gas of the last recorded operation; every later operation overwrote it. #11524 - The PAY opcode (EIP-5920, future EIPs fork only) pays from the current address instead of the caller. #11544 - A peer that answers a header, body or sync block body request with malformed RLP is now disconnected for breach

Recommended actions

• Upgrade Besu to 26.10.2 or later
• Check the release notes for any coordinated upgrade deadline or required configuration change

Source & attribution

This 0xCERT advisory relays the Besu 26.10.2 release notes: https://github.com/besu-eth/besu/releases/tag/26.10.2. Refer to the upstream project for the authoritative record and any follow-up security advisories.