-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0279
============================================================

Advisory-ID:  0xCERT-2026-0279
Severity:     Medium
Published:    2026-10-26T17:54:18.000Z
Updated:      2026-10-26T19:07:18.623Z
Chains:       Ethereum
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0279

Title: Besu 26.10.2: security release for Ethereum node operators

Summary
- -------
Besu 26.10.2 (released 2026-10-26) includes security fixes according to its release notes. Ethereum node operators running Besu should review and upgrade.

Details
- -------
Summary
Besu 26.10.2 (released 2026-10-26) includes security fixes according to its release notes. Ethereum node operators running Besu should review and upgrade.

Affected
- - Besu (hyperledger/besu) versions before 26.10.2

From the release notes
#11390
- - eth_getLogs and GraphQL logs now enforce the --rpc-max-log-filter-addresses cap on the address list that eth_newFilter and eth_subscribe already applied, closing that bypass of the fix for GHSA-p6f8-q9mp-7mj9. A request naming more addresses than the cap is rejected before any block is read: JSON-RPC returns Filter address count exceeds limit (-32005) and GraphQL returns Invalid params. The default stays 1000 addresses; --rpc-max-log-filter-addresses=0 keeps the previous uncapped behaviour. #11667
- - Debug traces with an opcode filter or a step limit report the post-execution gas of the last recorded operation; every later operation overwrote it. #11524
- - The PAY opcode (EIP-5920, future EIPs fork only) pays from the current address instead of the caller. #11544
- - A peer that answers a header, body or sync block body request with malformed RLP is now disconnected for breach

Recommended actions
- - Upgrade Besu to 26.10.2 or later
- - Check the release notes for any coordinated upgrade deadline or required configuration change

Source & attribution
This 0xCERT advisory relays the Besu 26.10.2 release notes: https://github.com/besu-eth/besu/releases/tag/26.10.2. Refer to the upstream project for the authoritative record and any follow-up security advisories.

References
- ----------
- - https://github.com/besu-eth/besu/releases/tag/26.10.2
- - GHSA-p6f8-q9mp-7mj9

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrgaasJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmdx7eBMtChJ8rSZmk0MeIq+n+GSjF0OYKVVz5sk
TLBmtBYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAADgfgD+I19617kibaBZV+wA
+GCAKbjTE1BGHZJdEPQsQX4rC44BAMULIxvgns+7rxcZAliFgPqmj9xDyd3W
+EyU/U6M/BwF
=FlFV
-----END PGP SIGNATURE-----