Ethereum clients Teku and Besu have updated their Docker images to remove trust in certificate roots identified in the response to the eMudhra certificate-authority compromise. Teku 26.10.3 was published October 27, while Besu 26.10.2 was published October 26, according to their official release records.
OpenJDK says private keys associated with eight eMudhra intermediate CA certificates were compromised. Both client releases remove trust in four root certificates listed in OpenJDK’s guidance.
Separate Java installations need review
Besu cautions that its certificate removal applies to Docker images. Operators running its downloadable archive with their own Java installation may still trust the affected authorities and need to check that runtime separately.
OpenJDK’s guidance recommends an updated runtime from the relevant vendor, or removal of the specified root certificates when an update is unavailable. The required steps vary by installation; its guidance includes a separate workaround for Java certificate stores on Debian and Ubuntu.
Sources: Teku 26.10.3 release notes, Besu 26.10.2 release notes, OpenJDK’s certificate guidance and the BlockBeats report, published October 29, 2026, at 05:38:57 UTC.