CVE-2026-40069 json
bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts
published 2026-04-09 7 mo ago modified 2026-10-26 14 d ago also GHSA-9hfr-gw99-8rhx , EUVD-2026-20994
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.1.0 to before 0.8.2, BSV::Network::ARC's failure detection only recognises REJECTED and DOUBLE_SPEND_ATTEMPTED. ARC responses with txStatus values of INVALID, MALFORMED, MINED_IN_STALE_BLOCK, or any ORPHAN-containing extraInfo / txStatus are silently treated as successful broadcasts. Applications that gate actions on broadcaster success are tricked into trusting transactions that were never accepted by the network. This vulnerability is fixed in 0.8.2.
Patch / fix
- rubygems bsv-sdk 0.8.2
- sgbett bsv_ruby_sdk 0.8.2
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | bsv-sdk | >=0.1.0, <0.8.2 |
0.8.2 |
Affected products
- sgbett bsv-ruby-sdk
Classification
- Weakness
-
- CWE-754 Improper Check for Unusual or Exceptional Conditions
References
-
github.com
/sgbett/bsv-ruby-sdk/pull/306
web, issue-tracking
-
github.com
/sgbett/bsv-ruby-sdk/commit/4992e8a265fd914a7eeb0405c69d1ff0122a84cc
web, patch
-
github.com
/sgbett/bsv-ruby-sdk/security/advisories/GHSA-9hfr-gw99-8rhx
web, patch, vendor-advisory
-
github.com
/sgbett/bsv-ruby-sdk/issues/305
web, issue-tracking
-
github.com
/sgbett/bsv-ruby-sdk/releases/tag/v0.8.2
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-40069
advisory
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/bsv-sdk/CVE-2026-40069.yml
web
-
github.com
/sgbett/bsv-ruby-sdk
package
Sources
- CVE List CVE-2026-40069
- GitHub Advisory GHSA-9hfr-gw99-8rhx
- NVD CVE-2026-40069
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.