CVE-2021-21369

Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 there is a denial-of-service vulnerability involving the HTTP JSON-RPC API service. If username and password authentication is enabled for the HTTP JSON-RPC API service, then prior to making any requests to an API endpoint the requestor must use the login endpoint to obtain a JSON web token (JWT) using their credentials. A single user can readily overload the login endpoint with invalid requests (incorrect password). As the supplied password is checked for validity on the main vertx event loop and takes a relatively long time this can cause the processing of other valid requests to fail. A valid username is required for this vulnerability to be exposed. This has been fixed in version 1.5.1.

• CWE-400

• https://github.com/hyperledger/besu/blob/master/CHANGELOG.md#151Release Notes, Third Party Advisory
• https://github.com/hyperledger/besu/commit/06e35a58c07a30c0fbdc0aae45a3e8b06b53c022Patch, Third Party Advisory
• https://github.com/hyperledger/besu/pull/1144Patch, Third Party Advisory
• https://github.com/hyperledger/besu/security/advisories/GHSA-qgfj-mjpc-7w3qThird Party Advisory
• https://github.com/hyperledger/besu/blob/master/CHANGELOG.md#151Release Notes, Third Party Advisory
• https://github.com/hyperledger/besu/commit/06e35a58c07a30c0fbdc0aae45a3e8b06b53c022Patch, Third Party Advisory
• https://github.com/hyperledger/besu/pull/1144Patch, Third Party Advisory
• https://github.com/hyperledger/besu/security/advisories/GHSA-qgfj-mjpc-7w3qThird Party Advisory

Published

Mar 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21363swagger-codegen is an open-source project which contains a t…7
• CVE-2021-21364swagger-codegen is an open-source project which contains a t…5.5
• CVE-2021-21365Bootstrap Package is a theme for TYPO3. It has been discover…5.4
• CVE-2021-21366xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…4.3
• CVE-2021-21367Switchboard Bluetooth Plug for elementary OS from version 2.…8.1
• CVE-2021-21368msgpack5 is a msgpack v5 implementation for node.js and the …8.8
• CVE-2021-2137Vulnerability in the Enterprise Manager Base Platform produc…8.8
• CVE-2021-21370TYPO3 is an open source PHP based web content management sys…5.4
• CVE-2021-21371Tenable for Jira Cloud is an open source project designed to…8.6
• CVE-2021-21372Nimble is a package manager for the Nim programming language…8.8
• CVE-2021-21373Nimble is a package manager for the Nim programming language…5.9
• CVE-2021-21374Nimble is a package manager for the Nim programming language…8.1