What is the CVSS score of CVE-2026-40069?

CVE-2026-40069 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-40069?

Within 24 hours: Inventory all applications and services using BSV Ruby SDK and document current deployed versions; verify whether transaction broadcast responses are used for critical business logic decisions (payments, access control, fund transfers). Within 7 days: Contact BSV Ruby SDK maintainers for patch status and estimated release timeline; implement compensating control (see below) to validate all ARC response codes before accepting broadcast confirmation. Within 30 days: Deploy patched SDK version once available; conduct transaction audit for any periods where incomplete validation may have occurred; validate that all critical workflows now properly reject failed transaction statuses.

Bsv Ruby Sdk CVE-2026-40069

Q: Which versions of Bsv Ruby Sdk are affected by CVE-2026-40069?

BSV Ruby SDK versions 0.1.0 through 0.8.1 contain a transaction validation defect that allows remote attackers to bypass broadcast failure detection, causing applications to incorrectly treat failed…. A patch is available.

EUVD-2026-20994 HIGH

Improper Check for Unusual or Exceptional Conditions (CWE-754)

2026-04-09 GitHub_M

GHSA-9hfr-gw99-8rhx

Information Disclosure Bsv Ruby Sdk

7.5

CVSS 3.1 · Vendor: GitHub_M

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft transaction with invalid status
Delivery

Send via BSV Ruby SDK ARC
Exploit

SDK mishandles non-REJECTED response
Execution

Application confirms false broadcast success
Impact

Attacker exploits unaccepted transaction state

Vulnerability Assessment

Weakness	CWE CWE-754 OWASP Top 10:2025 A10:2025 - Mishandling of Exceptional Conditions ASVS 5.0 V16 - Security Logging and Error Handling Unusual condition handling
Exploitation Conditions	BSV Ruby SDK versions 0.1.0 to 0.8.1. Application must use BSV::Network::ARC for blockchain transaction broadcasting and gate actions on broadcaster success. Remote unauthenticated attacker can craft ARC responses with txStatus values INVALID, MALFORMED, MINED_IN_STALE_BLOCK, or ORPHAN-containing extraInfo to trigger the vulnerability.
Impact	Unauthenticated network-accessible logic flaw in BSV Ruby SDK allows attackers to spoof failed blockchain transactions as successful, enabling financial fraud in dependent applications. High integrity impact (I:H) affects transaction validation logic; low EPSS suggests limited current exploitation, but risk is substantial for systems relying on this SDK for payment verification or settlement confirmation.
Exploit ScenarioDerived	Attacker sends crafted ARC response with txStatus=INVALID or ORPHAN to SDK application. Application incorrectly treats response as successful broadcast and proceeds with downstream actions (releasing goods, confirming payment). No authentication required; network-based attack vector.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 09, 2026

Incorrect transaction broadcast failure detection in BSV Ruby SDK 0.1.0 through 0.8.1 allows unauthenticated remote attackers to manipulate application logic by exploiting incomplete ARC response validation. The SDK's BSV::Network::ARC module only recognizes REJECTED and DOUBLE_SPEND_ATTEMPTED status codes as failures, silently treating INVALID, MALFORMED, MINED_IN_STALE_BLOCK, and ORPHAN-containing responses as successful broadcasts. Applications relying on broadcast confirmation for gating critical actions accept failed transactions as valid, enabling integrity compromise in blockchain-dependent workflows. No public exploit identified at time of analysis.

RemediationAI

Vendor-released patch: upgrade to BSV Ruby SDK version 0.8.2 or later, which implements comprehensive ARC response validation covering all documented failure states. The fix expands failure detection logic to correctly identify INVALID, MALFORMED, MINED_IN_STALE_BLOCK, and ORPHAN status codes. Review application logic that depends on broadcast success confirmation to ensure proper error handling for previously misclassified failures. No workaround available for unpatched versions; applications using affected versions should prioritize immediate upgrade to prevent transaction validation bypass. Full technical details and patched code available in GitHub security advisory: https://github.com/sgbett/bsv-ruby-sdk/security/advisories/GHSA-9hfr-gw99-8rhx. Commit implementing fix: https://github.com/sgbett/bsv-ruby-sdk/commit/4992e8a265fd914a7eeb0405c69d1ff0122a84cc.

Affected VersionsENISA

bsv-ruby-sdk 0.1.0, < 0.8.2

Affected Packages

rubygems bsv-sdk fix: 0.8.2

euvd bsv_ruby_sdk_0_1_0 fix: 0.8.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in rubygems, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Root cause stems from incomplete enumeration of failure conditions (CWE-754) in ARC transaction status parsing logic. The network broadcast handler implements a whitelist approach that only validates two explicit failure states, defaulting all unrecognized ARC protocol responses to success. This creates a logic gap where multiple legitimate failure statuses bypass detection, violating fail-secure principles in blockchain transaction validation workflows.

Know when Bsv Ruby Sdk gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 10, 2026 - 02:30 nvd

Patch available

CVE Published

Apr 09, 2026 - 17:22 nvd

HIGH 7.5

DescriptionCVE.org

BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.1.0 to before 0.8.2, BSV::Network::ARC's failure detection only recognises REJECTED and DOUBLE_SPEND_ATTEMPTED. ARC responses with txStatus values of INVALID, MALFORMED, MINED_IN_STALE_BLOCK, or any ORPHAN-containing extraInfo / txStatus are silently treated as successful broadcasts. Applications that gate actions on broadcaster success are tricked into trusting transactions that were never accepted by the network. This vulnerability is fixed in 0.8.2.

Executive ViewAI

Why It Matters

BSV Ruby SDK versions 0.1.0 through 0.8.1 contain a transaction validation defect that allows remote attackers to bypass broadcast failure detection, causing applications to incorrectly treat failed blockchain transactions as successful. Organizations using this SDK for payment processing, fund transfers, or other transaction-gated workflows face integrity compromise where attackers can manipulate application logic without authentication, potentially enabling fraudulent transactions or state inconsistencies.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Implement immediate application-level validation: modify all code paths consuming ARC responses to explicitly validate that responses contain ONLY ACCEPTED or SUCCESS status codes; reject and log any INVALID, MALFORMED, MINED_IN_STALE_BLOCK, or ORPHAN statuses as broadcast failures; add transaction retry logic with exponential backoff; implement compensating transaction confirmation via independent blockchain state verification (query blockchain directly rather than relying solely on SDK ARC module responses).

Threat Intelligence Overview

EPSS Score

0.0%

Top 91% exploitable

Threat Intel

1 source

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.