Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

besu-eth/besu

              main @ 6298195
            

151

Fixes

CVEs

CRITICAL

Peak severity

33.3%

Coverage

Highlights

Denial of Service: 50 prior fixes. Scrutinize any change in this area.

ethereum/core/src/main/java/org/hyperledger/besu/ethereum/mainnet/MainnetTransactionValidator.java: most-fixed (5 issues). Treat as high-risk during review.

93 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Recurring unbounded queries (logs, filters, trace ranges, block ranges, batch sizes, frame sizes, active connections) exhaust CPU/memory; multiple fixes added caps but sibling methods may still lack them.

Auth Bypass: Multiple fixes address JWT/HMAC misuse, missing authentication on WebSocket, host header parsing, and fork validation ordering; residual risk in alternate RPC entry points.

Auth Bypass: Case-sensitivity, ABI encoding, direction of connection, and OR-vs-AND logic errors repeatedly allowed unauthorized peers/accounts/transactions; each fix is narrow and sibling controllers may still be vulnerable.