Ethereum client Besu fixed five security vulnerabilities identified by blockchain security company CertiK in version 26.7.1, released on July 27. CertiK published four detailed security announcements on August 14, after delaying the disclosures to give node operators time to deploy the upgrade. Jialiang Chang, CertiK's Director of Security Engineering and Senior Audit Partner, said the patch-first, details-later approach created an 18-day buffer for operators to identify affected deployments, test the new version and coordinate upgrades with validators or consortium participants. The vulnerabilities affect block broadcasting, future-height consensus proposal caching, WebSocket subscription limits and JSON-RPC filter creation. Without fixes, attackers could exhaust node memory or thread resources, potentially disrupting node availability and consensus processing. CertiK used its Chain Scan method for adversarial testing across peer-to-peer, HTTP RPC, WebSocket RPC and consensus interfaces in a private multi-node test network, and supplied reproducible testing tools to the Besu team. The company is updating Chain Scan to expand around-the-clock multi-node testing for public chain networks.