stakestack
UTC
GitHub

Besu

Consensys / LF Decentralized Trust · Java · Apache-2.0

Java execution client (formerly Hyperledger Besu).

executionEthereum MainnetHoodiSepoliaHoleskyEphemery
hyperledger/besuDocsWebsitehyperledger/besu

Repository may redirect to a new org after the LF Decentralized Trust move; the GitHub API follows the redirect.

Required by network upgrades

UpgradeNetworkMinimum
GlamsterdamSepolia≥ 26.9.0
FusakaEthereum Mainnet≥ 25.11.0

Releases

Rated by the teku-notes rules · weight 1.5
Channel
Severity
Type
Network
Fork
33 releases
Besu26.10.2
Why this rating
  • security wording: "- eth_getLogs and GraphQL logs now enforce the --rpc-max-log-filter-addresses cap on the address list that eth_newFilter and eth_subscribe already applied, closing that bypass of …"
  • Security: Docker images no longer trust the eMudhra roots listed in OpenJDK's guidance after the October 2026 CA compromise - emSign ECC Root CA - G3 (related to the com…
  • Breaking changes: - eth_getProof now rejects a request with more than 1024 storage keys with Invalid storage keys params (-32602), the same limit as geth, Nethermind and Erigon.…
  • performance wording: "- Update the discovery library to 26.10.1 for faster discv5 secp256k1 verification and ECDH, with Netty, BouncyCastle, Guava, Log4j and Reactor raised to the versions it requires.…"
Oct 26, 2026
Besu26.10.1
Why this rating
  • high (hoodi): If you operate nodes on Hoodi, upgrade to this version immediately.
Oct 22, 2026
Besu26.10.0
Why this rating
  • high (hoodi): Hoodi node operators must upgrade before then.
  • high (all networks): Operators are advised to upgrade promptly.
  • fork scheduled (hoodi): ## Headline: Amsterdam scheduled on Hoodi
  • fork scheduled (hoodi): - The Amsterdam hard fork is scheduled on Hoodi at timestamp 1793036568 (Mon, 26 Oct 2026, 17:42:48 UTC).
  • security wording: "26.10.0 This release contains security fixes."
Oct 16, 2026
Besu26.9.0
Why this rating
  • high (sepolia): Sepolia operators must upgrade before then.
  • high (all networks): Operators are advised to upgrade promptly.
  • fork scheduled (sepolia): 26.9.0 Amsterdam scheduled on Sepolia — Tue 6 Oct 2026, 13:53:36 UTC (timestamp 1791294816).
  • security wording: "This release contains security fixes."
  • Breaking changes: - BlockSimulationParameter.Builder.enforceConsensusGasLimitCaps() is renamed to enforceConsensusGasLimit(). The flag now also controls whether the EIP-1559 gas…
Sep 25, 2026
Besu26.8.1
Why this rating
  • security wording: "- Reject non-empty withdrawals in BFT blocks (GHSA-p4h2-gvh4-pv6j)"
  • Breaking changes: - JSON-RPC eth_newFilter and eth_subscribe (logs) now cap the number of addresses per filter at 1000 by default. Requests exceeding the limit are rejected with…
  • deprecation wording: "- PluginTransactionSelectorFactory.create(final SelectorsStateManager selectorsStateManager) is deprecated for removal"
Sep 1, 2026
Besu26.8.0
Why this rating
  • Breaking changes: - The experimental --Xv5-discovery-enabled flag is removed; discovery now defaults to --discovery-mode=V4. Use --discovery-mode=BOTH or --discovery-mode=V5 to …
  • deprecation wording: "- --min-block-occupancy-ratio is deprecated and will be removed in a future release"
Aug 19, 2026
Besu26.7.1
Why this rating
  • high (all networks): #### 🚨 Besu 26.7.1 fixes security vulnerabilities — upgrade ASAP.
  • security wording: "#### 🚨 Besu 26.7.1 fixes security vulnerabilities — upgrade ASAP."
  • Breaking changes: - If you are a heavy user of eth_newFilter/eth_newBlockFilter/eth_newPendingTransactionFilter RPC methods, you may need to review the default values of the new…
  • deprecation wording: "- --min-block-occupancy-ratio is deprecated and will be removed in a future release"
Jul 27, 2026
Besu26.7.0
Why this rating
  • Breaking changes: - Sunsetting features is now complete - for more context on the reasoning behind these removals, read this blog post - Proof of Work consensus (PoW) removal is…
  • deprecation wording: "- --min-block-occupancy-ratio is deprecated and will be removed in a future release"
  • performance wording: "- Improve BAL prefetcher collectKeys performance (fewer allocations, less stream overhead) #10788"
Jul 13, 2026
Besu26.6.1
Why this rating
  • Breaking changes: - RPC changes to enhance compatibility with other ELs - The block parameter is now optional on eth_getBalance, eth_getCode, eth_getStorageAt, eth_getTransactio…
  • low (all networks): 26.6.1 This is an optional update.
  • deprecation wording: "- Sunsetting features - for more context on the reasoning behind the deprecation of these features, including alternative options, read this blog post"
Jun 17, 2026
Besu26.6.0
Why this rating
  • high (all networks): > [!IMPORTANT] You must upgrade Java to version 25+ to run this release.
  • medium (all networks): 26.6.0 This is a recommended update for all users.
  • security wording: "Besu's usage patterns are not affected by these vulnerabilities. #10420"
  • Breaking changes: - Besu now requires JDK 25 to build and run. - RPC changes to enhance compatibility with other ELs - Block number parameter in RPCs now only supports hex value…
  • deprecation wording: "- Sunsetting features - for more context on the reasoning behind the deprecation of these features, including alternative options, read this blog post"
Jun 4, 2026
Besu26.5.0
Why this rating
  • security wording: "- Fix CVE-2026-34480 and CVE-2026-34478 in log4j #10332"
  • Breaking changes: - Plugin API - Removed BesuConfiguration#getRpcHttpHost() and BesuConfiguration#getRpcHttpPort() which have been deprecated since 25.1.0. Use getConfiguredRpcH…
  • deprecation wording: "- Removed BesuConfiguration#getRpcHttpHost() and BesuConfiguration#getRpcHttpPort() which have been deprecated since 25.1.0."
  • performance wording: "- Reduce memory copying in eth/snap message handling and improve RLP performance #10130"
May 12, 2026
Besu26.4.0
Why this rating
  • Breaking changes: - Clique consensus has been removed. Besu can no longer start or mine on pure Clique networks. Syncing networks that started as Clique and have since transitio…
  • deprecation wording: "- Deprecated --min-block-occupancy-ratio for removal and make it noop."
  • performance wording: "- Experimental Bonsai Archive column families have changed to improve performance during bonsai to archive migration."
Apr 22, 2026
Besu26.2.0
Why this rating
  • medium (all networks): This is a recommended update for all users.
  • Breaking changes: - ETC Classic support in Besu is removed. This includes all ETC related hardforks including Mordor and Spiral. #9671 - Forest db subcommands x-backup-state and…
  • deprecation wording: "- CHECKPOINT sync is deprecated."
  • performance wording: "- Improve performance of snap sync chain download #9510 and #9621"
Mar 5, 2026
Besu26.1.0
Why this rating
  • medium (all networks): This is a recommended update for all users.
  • Breaking changes: - Remove experimental CLI flag --Xenable-extra-debug-tracers. Call tracer (callTracer) is now always available for debug_trace* methods. - RPC changes to enhan…
  • deprecation wording: "Support for non-hex (decimal) block number parameters is deprecated."
  • performance wording: "- Optimise ADD Opcode: ADD 86% faster, using new UInt256 implementation #9477"
Feb 3, 2026
Besu25.12.0
Why this rating
  • Breaking changes: - Remove these deprecated CLI options #9385 - Remove--Xbonsai-parallel-tx-processing-enabled deprecated since 25.7.0. Use --bonsai-parallel-tx-processing-enabl…
  • deprecation wording: "- Remove these deprecated CLI options #9385"
  • performance wording: "- 5-6x faster toFastHex calculation for engine_getBlobsV2 #9426"
Dec 12, 2025
Besu25.11.0
Why this rating
  • high (mainnet): This is a mandatory update for Mainnet users. > - Adds Osaka, BPO1, and BPO2 fork times for Mainnet > - Increases the Mainnet gas limit to 60M.
  • high (mainnet): All Mainnet nodes must be updated before the activation of the Fusaka fork:
  • deprecation wording: "- Deprecated CLI options"
Nov 5, 2025
Besu25.10.0
Why this rating
  • fork scheduled (holesky): - Holesky scheduled to fork on 2025-10-01 08:48:00
  • fork scheduled (sepolia): - Sepolia scheduled to fork on 2025-10-14 07:36:00
  • fork scheduled (hoodi): - Hoodi scheduled to fork on 2025-10-28 18:53:12
  • medium (hoodi, sepolia, holesky): This is a recommended update for Holesky, Sepolia and Hoodi users for the upcoming Fusaka hardfork.
  • low (mainnet): ## 25.10.0 - Fusaka Testnet Release > [!IMPORTANT] > This is an optional update for Mainnet users.
Oct 16, 2025
Besu25.10.0-RC2
Why this rating
  • medium (mainnet, sepolia, holesky): > [!IMPORTANT] > This RC is a recommended update for Holesky and Sepolia users for the Fusaka hardfork. > This RC is still pending burn in for mainnet.
  • deprecation wording: "- Deprecated CLI options"
  • performance wording: "- Performance improvements to EQ opcode #9229"
Oct 3, 2025
Besu25.10.0-RC1
Why this rating
  • fork scheduled (holesky): - Holesky scheduled to fork on 2025-10-01 08:48:00
  • fork scheduled (sepolia): - Sepolia scheduled to fork on 2025-10-14 07:36:00
  • fork scheduled (hoodi): - Hoodi scheduled to fork on 2025-10-28 18:53:12
  • low (sepolia, holesky): > [!IMPORTANT] > This RC is an optional update for Holesky and Sepolia users.
  • deprecation wording: "- Deprecated CLI options"
Oct 1, 2025
Besu25.9.0
Why this rating
  • high (hoodi, sepolia, holesky): This is a required update for Holesky, Sepolia and Hoodi users for the upcoming Fusaka hardfork.
  • fork scheduled (holesky): - Holesky scheduled to fork on 2025-10-01 08:48:00
  • fork scheduled (sepolia): - Sepolia scheduled to fork on 2025-10-14 07:36:00
  • fork scheduled (hoodi): - Hoodi scheduled to fork on 2025-10-28 18:53:12
  • Breaking changes: - Remove deprecated option --bonsai-maximum-back-layers-to-load (deprecated since 23.4.0). Use --bonsai-historical-block-limit instead
Sep 24, 2025
Besu25.8.0
Why this rating
  • high (all networks): ## 25.8.0 This is a required update for all users.
  • security wording: "- resolves CVE-2025-48924"
  • Security: - Dependency updates including fixing CVEs
  • Breaking changes: - Change in behavior for eth_estimateGas to improve accuracy when used on a network with a base fee market. - if there are no gas pricing parameters specified …
  • deprecation wording: "- Remove PoAMetricsService and IbftQueryService which have been deprecated since 2019 and are replaced by PoaQueryService and BftQueryService respectively #8940"
Aug 29, 2025
Besu25.7.0
Why this rating
  • Breaking changes: - Changes in Maven coordinates of Besu artifacts to avoid possible collisions with other libraries when packaging plugins. See Appendix A for a mapping. #8589 …
  • deprecation wording: "- Breaking Changes: Cleanup of deprecated code—please review carefully!"
  • performance wording: "- Experimental Bonsai Archive support is now available but remains experimental pending mainnet performance validation."
Jul 3, 2025
Besu25.6.0
Why this rating
  • Breaking changes: - Sunset features - for more context on the reasoning behind the removal of these features, including alternative options, read this blog post - Remove onchain…
  • low (all networks): This is an optional update.
  • deprecation wording: "- Remove MetricSystem::createLabelledGauge deprecated since 24.12.0, replace it with MetricSystem::createLabelledSuppliedGauge #8299"
Jun 4, 2025
Besu25.6.0-RC1
Why this rating
  • performance wording: "--threads will default to one less than the number of processors available on your system, so it is safe to omit --prune-range-size will default to 10000 and can be adjusted if de…"
May 30, 2025
Besu25.5.0
Why this rating
  • Breaking changes: - Changes to gas estimation algorithm for eth_estimateGas and eth_createAccessList #8478 - if you require the previous behavior, specify --estimate-gas-toleran…
  • deprecation wording: "- MetricSystem::createLabelledGauge is deprecated and will be removed in a future release, replace it with MetricSystem::createLabelledSuppliedGauge"
  • performance wording: "- Add experimental --profile=PERFORMANCE for high spec nodes: increases rocksdb cache and enables parallel transaction processing #8560"
May 15, 2025
Besu25.4.1
Why this rating
  • high (all networks); high (mainnet): This is a mandatory update, you must update your Mainnet node before the activation of Pectra scheduled for epoch 364032 on 07 May 2025 at 10:05:11 AM UTC.
  • fork scheduled (mainnet): This is a mandatory update, you must update your Mainnet node before the activation of Pectra scheduled for epoch 364032 on 07 May 2025 at 10:05:11 AM UTC.
  • Breaking changes: - --compatibility-eth64-forkid-enabled has been removed. #8541
  • deprecation wording: "- MetricSystem::createLabelledGauge is deprecated and will be removed in a future release, replace it with MetricSystem::createLabelledSuppliedGauge"
Apr 16, 2025
Besu25.4.0
Why this rating
  • security wording: "- Upgrade spring-security-crypto to address CVE-2025-22228 #8448"
  • low (all networks): This is an optional update.
  • deprecation wording: "- MetricSystem::createLabelledGauge is deprecated and will be removed in a future release, replace it with MetricSystem::createLabelledSuppliedGauge"
Apr 8, 2025
Besu25.3.0
Why this rating
  • medium (mainnet): 25.3.0 This is a strongly recommended update for all users, including Mainnet.
  • security wording: "- Upgrade Netty to version 4.1.118 to fix CVE-2025-24970 #8275"
  • consensus-safety wording: "- Change Invalid block, unable to parse RLP RPC error message to Invalid block param (block not found) #8328"
  • Breaking changes: NOTE: This release breaks native Windows compatibility for mainnet ethereum configurations. As the prague(pectra) hardfork require BLS12-381 precompiles and be…
  • deprecation wording: "- MetricSystem::createLabelledGauge is deprecated and will be removed in a future release, replace it with MetricSystem::createLabelledSuppliedGauge"
Mar 18, 2025
Besu25.2.2
Why this rating
  • high (sepolia): ## 25.2.2 This is a hotfix release for Pectra Sepolia testnets You need to update IF (and ONLY IF) you are running Besu on Sepolia Identical to 25.2.1 with one change:
Mar 5, 2025
Besu25.2.1
Why this rating
  • high (sepolia, holesky): You need to update IF (and ONLY IF) you are running Besu on Holesky or Sepolia Identical to 25.2.0 with one change:
Feb 25, 2025
Besu25.2.0
Why this rating
  • high (sepolia, holesky): This is a required update for Holesky and Sepolia users for the upcoming Pectra hardfork.
  • Breaking changes: - rpc-gas-cap default value has changed from 0 (unlimited) to 50M. If you require rpc-gas-cap greater than 50M, you'll need to set that explicitly. #8251
  • low (mainnet): 25.2.0 This is an optional update for Mainnet users.
  • deprecation wording: "- MetricSystem::createLabelledGauge is deprecated and will be removed in a future release, replace it with MetricSystem::createLabelledSuppliedGauge"
Feb 12, 2025
Besu25.1.0
Why this rating
  • Breaking changes: - --host-whitelist has been deprecated since 2020 and this option is removed. Use the equivalent --host-allowlist instead. - Changed tracer API to include the …
  • low (all networks): 25.1.0 This is an optional update.
  • deprecation wording: "- --host-whitelist has been deprecated since 2020 and this option is removed."
  • performance wording: "- This results in performance degradation as the system falls back to Java implementations instead."
Jan 23, 2025
Besu24.12.2
Why this rating
  • hotfix wording: "The only difference compared with 24.12.1 is a hotfix for the serialization of account state overrides for eth_call when movePrecompileToAddress is present."
Dec 16, 2024