CVE-2025-30147: Hyperledger Besu Consensus Vulnerability

CVE-2025-30147 Overview

CVE-2025-30147 is a consensus vulnerability in Hyperledger Besu, an enterprise-grade Ethereum client. The flaw affects the native implementations of the ALTBN128_ADD (0x06), ALTBN128_MUL (0x07), and ALTBN128_PAIRING (0x08) precompiles. Besu versions 24.7.1 through 25.2.2, which correspond to besu-native versions 0.9.0 through 1.2.1, rely on gnark-crypto's bn254 implementation. The library performs subgroup checks but skips point-on-curve validation. A specially crafted elliptic curve point can cause Besu to return incorrect results and drop out of consensus with other Ethereum clients.

Critical Impact
Attackers can craft EC points that cause Besu nodes to fall out of consensus, and homogeneous Besu-only networks can enshrine invalid state that becomes difficult to reconcile with patched nodes.

Affected Products

Hyperledger Besu versions 24.7.1 through 25.2.2
besu-native versions 0.9.0 through 1.2.1
Ethereum networks running Besu as a consensus client

Discovery Timeline

2025-05-07 - CVE-2025-30147 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-30147

Vulnerability Analysis

The vulnerability resides in Besu's native precompile handlers for the alt-bn128 elliptic curve operations defined by the Ethereum Virtual Machine. These precompiles support zk-SNARK verification and are addressed at 0x06, 0x07, and 0x08. The native implementations were rewritten in besu-native 0.9.0 using gnark-crypto's bn254 module to replace an unmaintained predecessor library. Besu began routing precompile calls through this code in version 24.7.1.

The defect is classified as [CWE-325] (Missing Cryptographic Step). The implementation assumed that gnark-crypto's subgroup check also validated that the point lay on the curve. The version of gnark-crypto in use performed only the subgroup membership check. As a result, a point with coordinates outside the bn254 curve but inside the correct subgroup passes validation and is processed as valid input.

Root Cause

The root cause is a missing point-on-curve verification step in the native precompile path. Subgroup checks alone are not sufficient to confirm that an input point belongs to the bn254 curve. The native Java code delegated this responsibility to gnark-crypto without performing an independent curve membership test. When the underlying library skips that check, malformed inputs flow through arithmetic operations and produce results that diverge from reference Ethereum clients such as Geth and Nethermind.

Attack Vector

An attacker submits an Ethereum transaction whose payload invokes one of the affected precompiles with a crafted EC point. Besu nodes compute a result that differs from other clients, causing a chain split. On networks composed entirely of Besu nodes, the divergent state can be accepted and persisted, creating long-term reconciliation problems once patched nodes are introduced. No authentication is required; the attack vector is fully network-based via standard transaction submission.

No verified proof-of-concept code is published. Refer to the GitHub Security Advisory GHSA-jcp8-gh74-97hq for technical specifics on the malformed point construction.

Detection Methods for CVE-2025-30147

Indicators of Compromise

Besu nodes reporting state root mismatches or block import failures when peering with Geth, Nethermind, or Erigon clients
Transactions invoking precompile addresses 0x06, 0x07, or 0x08 with non-standard input lengths or unusual point coordinates
Unexpected forks observed in Besu-only networks that resolve differently on patched nodes

Detection Strategies

Compare block hashes and state roots between Besu and at least one alternate Ethereum client running against the same network
Audit transaction logs for calls to ALTBN128 precompiles and replay suspect transactions against a patched Besu instance
Monitor consensus engine logs for BadBlock or peer disagreement events tied to precompile execution

Monitoring Recommendations

Track Besu version inventory across all validator and RPC nodes and flag instances running 24.7.1 through 25.2.2
Alert on divergence between Besu node head block and head blocks reported by heterogeneous client peers
Log and review use of the --Xevm-jumpdest-cache-weight-kb and native library flags configured via NativeLibraryOptions.java

How to Mitigate CVE-2025-30147

Immediate Actions Required

Upgrade all Besu nodes to version 25.3.0 or later, which bundles besu-native 1.3.0 with the fixed point-on-curve validation
Inventory Besu deployments and prioritize validators, block producers, and RPC endpoints exposed to untrusted transactions
On homogeneous Besu networks, audit recent state for entries produced by ALTBN128 precompile calls before introducing patched clients

Patch Information

The upstream fix is included in besu-native release 1.3.0 and Hyperledger Besu version 25.3.0. The patch adds explicit point-on-curve checks alongside subgroup validation in the alt-bn128 precompile path. Review the GitHub Security Advisory GHSA-jcp8-gh74-97hq for full release notes.

Workarounds

Disable the native alt-bn128 precompile implementation and fall back to the pure-Java version using Besu's native library command-line options
Accept the performance penalty of the Java implementation as a temporary measure until upgrade to 25.3.0 is complete
Restrict transaction submission from untrusted sources on validator nodes pending patch deployment

bash

# Disable native alt-bn128 precompile and use pure-Java implementation
besu --Xaltbn128-native-enabled=false