CVE-2026-40069highCWE-754

CVE-2026-40069: falha de alta gravidade em sgbett bsv-ruby-sdk

bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar bsv-ruby-sdk+ Monitorar bsv-sdk

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.3%
BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.1.0 to before 0.8.2, BSV::Network::ARC's failure detection only recognises REJECTED and DOUBLE_SPEND_ATTEMPTED. ARC responses with txStatus values of INVALID, MALFORMED, MINED_IN_STALE_BLOCK, or any ORPHAN-containing extraInfo / txStatus are silently treated as successful broadcasts. Applications that gate actions on broadcaster success are tricked into trusting transactions that were never accepted by the network. This vulnerability is fixed in 0.8.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
sgbett · bsv-ruby-sdk
CVEs relacionadas — sgbett bsv-ruby-sdk

No mesmo produto, das mais perigosas para as menos.

CVE-2026-40070HIGHbsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)EPSS 0.1%