# CVE-2025-30147 - The curious case of subgroup check on Besu

DevFeed: [CVE-2025-30147 - The curious case of subgroup check on Besu](<https://devfeed.tech/articles/cve-2025-30147-the-curious-case-of-subgroup-check-on-besu-17158.md>)

Original publisher: [Read original article](<https://blog.ethereum.org/en/2025/05/07/the-curious-case>)

Author: Antonio Sanso

Published: 2025-05-07T00:00:00Z

Content type: article

Language: en

Sources: [Ethereum Foundation Blog](<https://devfeed.tech/sources/ethereum-foundation-blog.md>)

Topics: [Ethereum](<https://devfeed.tech/topics/ethereum.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Cryptography](<https://devfeed.tech/topics/cryptography.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [2025](<https://devfeed.tech/tags/2025.md>), [cryptography](<https://devfeed.tech/tags/cryptography.md>), [cve](<https://devfeed.tech/tags/cve.md>), [ethereum](<https://devfeed.tech/tags/ethereum.md>), [security](<https://devfeed.tech/tags/security.md>), [security-vulnerabilities](<https://devfeed.tech/tags/security-vulnerabilities.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

The article reports CVE-2025-30147, a consensus issue in Besu Ethereum execution client version 25.2.2 related to EIP-196 and EIP-197 precompiled contract handling for the bn254 elliptic curve. The issue was fixed in release 25.3.0, and the article explains the security importance of validating curve membership and subgroup membership.

## Source excerpt

Thanks to Marius Van Der Wijden for creating the test case and statetest, and for helping the Besu team confirm the issue. Also, kudos to the Besu team, the EF security team, and Kevaundray Wedderburn. Additionally, thanks to Yuxiang Qiu, Justin Traglia, Marius Van Der Wijden, Benedikt Wagner, and Kevaundray...