Polygon has disclosed several security vulnerabilities in its Bor and Heimdall clients, including denial-of-service risks and validator resource exhaustion. The flaws were already patched through the Austin and Kyoto hard forks before Polygon Labs made the details public, and no exploitation was observed on mainnet.
Polygon Labs' Validators Support Team disclosed a set of previously private security vulnerabilities on Thursday, days after quietly fixing them through two coordinated hard forks. The vulnerabilities could have disrupted the network's proof-of-stake operation, but Polygon said none were exploited before the patches went live.
What the vulnerabilities exposed
The flaws affected Polygon's Bor execution client and Heimdall consensus client, covering denial-of-service risks, validator resource exhaustion and issues in checkpoint and milestone processing. The most severe issue involved Heimdall, where a specially crafted transaction could force validators to perform excessive processing work. On the Bor side, L1-to-L2 state-sync events were effectively un-metered, letting them consume block resources without normal gas accounting, while a separate flaw in unbounded TxDependency data could stall block processing or crash connected peers.
Fixes shipped before disclosure
The Austin hard fork upgraded Bor to v2.10.0, introducing per-block gas bounds to close the state-sync gap, while the Kyoto fork upgraded Heimdall to v0.11.0, patching byte-level nesting checks in how the client handles protobuf Any messages. Both upgrades were validated on the Amoy testnet before reaching mainnet, and the forum disclosure followed the successful mainnet activation rather than preceding it. Nodes still running pre-fork binaries have already fallen out of consensus; Bor v2.10.0 is required for all Polygon PoS nodes, and Heimdall v0.11.0 is required for validators and full nodes.
Part of a broader upgrade pattern
Austin and Kyoto follow the Ithaca hard fork, activated in July 2026 to improve network liveness and payment reliability. The upgrades land as Polygon's validator community absorbs the shift from MATIC to POL and ongoing discussion of staking reform, including a proposed liquid staking token called sPOL. POL was trading around $0.10, down about 4% over the past week but up 44% over the past month.
Sources: Cointelegraph, Crypto Briefing
Trading involves risk.
Risk Disclaimer
