CVE-2026-40069

{
  "id": "CVE-2026-40069",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-09T18:17:03.043",
  "lastModified": "2026-10-26T00:10:00.150",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.1.0 to before 0.8.2, BSV::Network::ARC's failure detection only recognises REJECTED and DOUBLE_SPEND_ATTEMPTED. ARC responses with txStatus values of INVALID, MALFORMED, MINED_IN_STALE_BLOCK, or any ORPHAN-containing extraInfo / txStatus are silently treated as successful broadcasts. Applications that gate actions on broadcaster success are tricked into trusting transactions that were never accepted by the network. This vulnerability is fixed in 0.8.2."
    },
    {
      "lang": "es",
      "value": "BSV Ruby SDK es el SDK de Ruby para la cadena de bloques BSV. Desde la 0.1.0 hasta antes de la 0.8.2, la detección de fallos de BSV::Network::ARC solo reconoce REJECTED y DOUBLE_SPEND_ATTEMPTED. Las respuestas de ARC con valores de txStatus como INVALID, MALFORMED, MINED_IN_STALE_BLOCK, o cualquier extraInfo / txStatus que contenga ORPHAN, se tratan silenciosamente como transmisiones exitosas. Las aplicaciones que condicionan acciones al éxito del emisor son engañadas para confiar en transacciones que nunca fueron aceptadas por la red. Esta vulnerabilidad está corregida en la 0.8.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "sgbett",
          "product": "bsv-ruby-sdk",
          "versions": [
            {
              "version": ">= 0.1.0, < 0.8.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-13T20:11:39.186859Z",
          "id": "CVE-2026-40069",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:sgbett:bsv_ruby_sdk:*:*:*:*:*:ruby:*:*",
              "versionStartIncluding": "0.1.0",
              "versionEndExcluding": "0.8.2",
              "matchCriteriaId": "90A4B053-0571-45B3-85A6-0CE005E42D5E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/sgbett/bsv-ruby-sdk/commit/4992e8a265fd914a7eeb0405c69d1ff0122a84cc",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/sgbett/bsv-ruby-sdk/issues/305",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking"
      ]
    },
    {
      "url": "https://github.com/sgbett/bsv-ruby-sdk/pull/306",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking"
      ]
    },
    {
      "url": "https://github.com/sgbett/bsv-ruby-sdk/releases/tag/v0.8.2",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/sgbett/bsv-ruby-sdk/security/advisories/GHSA-9hfr-gw99-8rhx",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}