CVE-2026-40069 json
bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts
published 7mo ago modified 14d ago also EUVD-2026-20994 , GHSA-9hfr-gw99-8rhx
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.1.0 to before 0.8.2, BSV::Network::ARC's failure detection only recognises REJECTED and DOUBLE_SPEND_ATTEMPTED. ARC responses with txStatus values of INVALID, MALFORMED, MINED_IN_STALE_BLOCK, or any ORPHAN-containing extraInfo / txStatus are silently treated as successful broadcasts. Applications that gate actions on broadcaster success are tricked into trusting transactions that were never accepted by the network. This vulnerability is fixed in 0.8.2.
Patch / fix
- rubygems bsv-sdk 0.8.2
- sgbett bsv-wallet 0.8.2
- sgbett bsv_ruby_sdk 0.8.2
Is CVE-2026-40069 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6mo ago
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | bsv-sdk | >=0.1.0, <0.8.2 |
0.8.2 |
Affected products
- sgbett bsv-ruby-sdk
Classification
- Weakness
-
- CWE-754 Improper Check for Unusual or Exceptional Conditions
References
-
github.com
/sgbett/bsv-ruby-sdk/pull/306
web, issue-tracking
-
github.com
/sgbett/bsv-ruby-sdk/commit/4992e8a265fd914a7eeb0405c69d1ff0122a84cc
web, patch
-
github.com
/sgbett/bsv-ruby-sdk/security/advisories/GHSA-9hfr-gw99-8rhx
web, patch, vendor-advisory
-
github.com
/sgbett/bsv-ruby-sdk/issues/305
web, issue-tracking
-
github.com
/sgbett/bsv-ruby-sdk/releases/tag/v0.8.2
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-40069
advisory
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/bsv-sdk/CVE-2026-40069.yml
web
-
github.com
/sgbett/bsv-ruby-sdk
package
Sources
- CVE List CVE-2026-40069
- GitHub Advisory GHSA-9hfr-gw99-8rhx
- NVD CVE-2026-40069
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.