CVE-2026-40069highCWE-754

CVE-2026-40069: fallo de gravedad alta en sgbett bsv-ruby-sdk

bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear bsv-ruby-sdk+ Monitorear bsv-sdk

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.3%
BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.1.0 to before 0.8.2, BSV::Network::ARC's failure detection only recognises REJECTED and DOUBLE_SPEND_ATTEMPTED. ARC responses with txStatus values of INVALID, MALFORMED, MINED_IN_STALE_BLOCK, or any ORPHAN-containing extraInfo / txStatus are silently treated as successful broadcasts. Applications that gate actions on broadcaster success are tricked into trusting transactions that were never accepted by the network. This vulnerability is fixed in 0.8.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Productos afectados
sgbett · bsv-ruby-sdk
CVEs relacionadas — sgbett bsv-ruby-sdk

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-40070HIGHbsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)EPSS 0.1%