PT-2025-20289 · Hyperledger · Besu-Native+1

Asanso

·

Published

2025-05-07

·

Updated

2025-05-13

·

CVE-2025-30147

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Hyperledger Besu versions 24.7.1 through 25.2.2 besu-native versions 0.9.0 through 1.2.1
Description The issue concerns a potential consensus bug in the precompiles ALTBN128 ADD (0x06), ALTBN128 MUL (0x07), and ALTBN128 PAIRING (0x08) due to the use of gnark-crypto's bn254 implementation in besu-native. This implementation relies on subgroup checks to perform point-on-curve checks, but the version of gnark-crypto used did not do this check when performing subgroup checks. As a result, it is possible for Besu to give an incorrect result and fall out of consensus when executing one of these precompiles against a specially crafted input point. Homogenous Besu-only networks can potentially enshrine invalid state which would be incorrect and difficult to process with patched versions of besu.
Recommendations For Hyperledger Besu versions 24.7.1 through 25.2.2, consider disabling the native precompile for altbn128 in favor of the pure-java implementation as a temporary workaround. Update to Hyperledger Besu version 25.3.0, which includes the fixed besu-native release 1.3.0.

Exploit

Fix

Weakness Enumeration

CWE-325

Related Identifiers

CVE-2025-30147
GHSA-JCP8-GH74-97HQ

Affected Products

Hyperledger Besu
Besu-Native