Linuxfoundation Besu vulnerabilities

3 CVEs affecting Linuxfoundation Besu, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-36025, published 2022-09-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-21369, published 2021-03-09. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerability involving the HTTP JSON-RPC API…
CVE-2021-41272, published 2021-12-13. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. Besu is an Ethereum client written in Java. Starting in version 21.10.0, changes in the implementation of the SHL, SHR, and SAR operations resulted in the introduction of a signed type coercion error…
CVE-2022-36025, published 2022-09-24. Critical severity, CVSS 9.1. EPSS: 1.1% chance of exploitation in the next 30 days. Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An error in 32 bit signed and unsigned types…