Teku and Besu Remove Compromised eMudhra Roots After Weak CA Keys Found

Overview

• Researchers found weak private-key generation for eight eMudhra intermediate certificate authorities in mid-October, and eMudhra revoked the affected intermediates after disclosure.
• Teku published v26.10.3 and Besu published v26.10.2 to remove the specific eMudhra roots from their Docker images so containerized nodes no longer trust the compromised chains.
• Java’s default certificate checks do not enforce revocation, so operators running Teku or Besu outside Docker must update their local Java trust stores or install patched Java builds to fully remove the risk.
• If an attacker can intercept an HTTPS connection they could present a forged certificate that a vulnerable Java-based client accepts, which in some setups could let the attacker alter block proposals or redirect validator rewards; Teku says default mainnet configs were not affected and no exploitation has been reported.
• Separately, Ethereum developers merged a Glamsterdam spec change that sorts pending deposits by withdrawal credentials to stop deposits from routing to builder accounts, but client teams still need to adopt that change in their implementations.