CVE-2026-40069 Details
Description
BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.1.0 to before 0.8.2, BSV::Network::ARC's failure detection only recognises REJECTED and DOUBLE_SPEND_ATTEMPTED. ARC responses with txStatus values of INVALID, MALFORMED, MINED_IN_STALE_BLOCK, or any ORPHAN-containing extraInfo / txStatus are silently treated as successful broadcasts. Applications that gate actions on broadcaster success are tricked into trusting transactions that were never accepted by the network. This vulnerability is fixed in 0.8.2.
A vulnerability exists in the BSV Ruby SDK's ARC broadcaster implementation, specifically in versions 0.1.0 prior to 0.8.2. The issue arises because the broadcaster fails to properly recognize and handle certain transaction rejection statuses. While it acknowledges 'REJECTED' and 'DOUBLE_SPEND_ATTEMPTED', it mistakenly treats 'INVALID', 'MALFORMED', 'MINED_IN_STALE_BLOCK', and any 'ORPHAN'-related statuses as successful broadcasts. This mismanagement can deceive applications into trusting transactions that were never accepted by the network, particularly those that rely on the broadcaster's success to validate actions or progress workflows.
Upgrade to BSV Ruby SDK version 0.8.2 or later. This version expands the failure detection to include all necessary rejection statuses and aligns the response handling with the TypeScript reference SDK. After upgrading, verify that the application correctly handles ARC responses and does not mistakenly trust transactions that were rejected.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sgbett bsv ruby sdk | >= 0.1.0, < 0.8.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 30, 2026 | Reanalysis | [email protected] |
| Apr 28, 2026 | Initial Analysis | [email protected] |
| Apr 9, 2026 | New CVE Received | [email protected] |