Ethereum client releases security update: fixes eMudhra certificate vulnerability, default mainnet nodes unaffected

The cryptographic security vulnerability of the Indian certificate authority eMudhra affects the Ethereum clients Teku and Besu. Researchers found that the private keys of 8 intermediate certificate authorities under eMudhra could potentially be deduced due to insufficient randomness, allowing attackers to forge certificates and trick unpatched software into trusting malicious services.

Teku has released version 26.1.3, and Besu has released version 26.1.2, both of which have removed trust in the relevant certificates from their Docker images. If an attacker performs a man-in-the-middle attack, they could trick some validators into sending block fee rewards to the attacker's address; the risk may be higher under specific configurations using external signers. The Teku team stated that the default configuration of the Ethereum mainnet Teku node is not affected, and no action is required, with no reports of the vulnerability being exploited so far.

For operators running Teku or Besu directly on the host without using Docker, simply updating the client may not be sufficient; they also need to manually update Java and its trusted certificate list. Operators still using the no longer maintained Java 26 will need to migrate to Java 25.