Ethereum node clients Teku and Besu have released Docker security fixes; binary users must individually check their Java runtime environments.

On October 29, according to CryptoSlate, Ethereum node clients Teku and Besu have released Docker security fixes in response to the eMudhra certificate authority (CA) breach. Teku 26.10.3 (released October 27) and Besu 26.10.2 (released October 26) have removed four root certificates—emSign ECC Root CA – G3, emSign Root CA – G1, emSign Root CA – G2, and AAA Certificate Services—from their Docker image truststores.

The incident involves the private keys of eight emSign G3 intermediate CAs under eMudhra being recoverable. eMudhra acknowledged that a script error led to the generation of weak keys, and the relevant intermediate certificates were revoked following the report received on October 17. However, Teku's security advisory notes that Java does not check certificate revocation status by default, so affected runtimes still require manual fixes.

Operators using binary installations (Teku binary distributions, Besu tar/zip) rely on their own installed Java and must check and fix it separately. Updating Java only on the host machine will not change the runtime within the container.

Teku stated that no exploitation of the vulnerability has been detected yet. Default mainnet nodes without configured HTTPS URLs are unaffected, and their libp2p and discv5 peer-to-peer networks are also not involved in this issue. The risk primarily affects HTTPS connections for remote signers, beacon nodes, execution clients, builders, or relays: if an attacker intercepts connections in unpatched runtimes, they could impersonate a remote beacon node, causing proposal fees to be redirected or validator duties to be missed. If impersonating an external signer, they could obtain validator exit signatures.