CVE-2026-40069

HIGH 7.5

bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

9th

BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.1.0 to before 0.8.2, BSV::Network::ARC's failure detection only recognises REJECTED and DOUBLE_SPEND_ATTEMPTED. ARC responses with txStatus values of INVALID, MALFORMED, MINED_IN_STALE_BLOCK, or any ORPHAN-containing extraInfo / txStatus are silently treated as successful broadcasts. Applications that gate actions on broadcaster success are tricked into trusting transactions that were never accepted by the network. This vulnerability is fixed in 0.8.2.

CWE	CWE-754
Vendor	sgbett
Product	bsv-ruby-sdk
Published	Apr 9, 2026
Last Updated	Apr 13, 2026

Stay Ahead of the Next One

Get instant alerts for sgbett bsv-ruby-sdk

Be the first to know when new high vulnerabilities affecting sgbett bsv-ruby-sdk are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

sgbett / bsv-ruby-sdk

>= 0.1.0, < 0.8.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/sgbett/bsv-ruby-sdk/security/advisories/GHSA-9hfr-gw99-8rhx github.com: https://github.com/sgbett/bsv-ruby-sdk/issues/305 github.com: https://github.com/sgbett/bsv-ruby-sdk/pull/306 github.com: https://github.com/sgbett/bsv-ruby-sdk/commit/4992e8a265fd914a7eeb0405c69d1ff0122a84cc github.com: https://github.com/sgbett/bsv-ruby-sdk/releases/tag/v0.8.2