Ethereum clients patch eMudhra certificate vulnerability
4.3 Security Teku and Besu fixed a security flaw from eMudhra’s certificates, removing trust in affected roots. Mainnet nodes were safe, but non-Docker operators must update Java manually.
Ethereum clients Teku and Besu have issued urgent security updates following the discovery of a cryptographic vulnerability at Indian certificate authority eMudhra. Researchers found that weak randomness in eMudhra's key generation allowed attackers to derive private keys for eight intermediate certificate authorities. This flaw exposed some validator setups to risks such as impersonation and man-in-the-middle attacks, potentially enabling attackers to forge certificates and redirect block rewards. Both Teku (v26.10.3) and Besu (v26.10.2) responded by removing trust in the compromised certificate roots from their Docker images. Importantly, default mainnet nodes were not affected, and no exploitation has been reported so far. Operators using external services over HTTPS or running non-Docker installations must manually update their Java runtimes and trust stores, as the client updates do not alter host-level trust. This incident underscores the need for regular software updates and vigilant monitoring of certificate authority security.
