CVE-2026-40069 is a high-severity (CVSS 7.5) CWE-754 vulnerability in bsv-sdk. A fix is available for bsv-sdk — see the affected versions and patch details below.
bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-40069.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
CVE-2026-40069 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 378,567 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
bsv-sdkReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.
Description
ARC broadcaster treats failure statuses as successful broadcasts
Summary
BSV::Network::ARC's failure detection only recognises REJECTED and DOUBLE_SPEND_ATTEMPTED. ARC responses with txStatus values of INVALID, MALFORMED, MINED_IN_STALE_BLOCK, or any ORPHAN-containing extraInfo / txStatus are silently treated as successful broadcasts. Applications that gate actions on broadcaster success are tricked into trusting transactions that were never accepted by the network.
Details
lib/bsv/network/arc.rb (lines ~74-100 in the affected code) uses a narrow failure predicate compared to the TypeScript reference SDK. The TS broadcaster additionally recognises:
INVALIDMALFORMEDMINED_IN_STALE_BLOCK- Any response containing
ORPHANinextraInfoortxStatus
The Ruby implementation omits all of these, so ARC responses carrying any of these statuses are returned to the caller as successful broadcasts.
Additional divergences in the same module compound the risk:
Content-Typeis sent asapplication/octet-stream; the TS reference sendsapplication/jsonwith a{ rawTx: <hex> }body (EF form where source transactions are available).- The headers
XDeployment-ID,X-CallbackUrl, andX-CallbackTokenare not sent.
The immediate security-relevant defect is the missing failure statuses; the other divergences are fixed in the same patch for protocol compliance.
Impact
Integrity: callers receive a success response for broadcasts that were actually rejected by the ARC endpoint. Applications and downstream gems that gate actions on broadcaster success — releasing goods, marking invoices paid, treating a token as minted, progressing a workflow — are tricked into trusting transactions that were never broadcast.
This is an integrity bug with security consequences. It does not disclose information (confidentiality unaffected) and does not affect availability.
CVSS rationale
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N → 7.5 (High)
- AV:N — network-reachable.
- AC:L — no specialised access conditions are required. Triggering any of the unhandled failure statuses is not meaningfully harder than broadcasting a transaction at all: a malformed or invalid transaction, an orphan condition from a transient fork, or a hostile/misbehaving ARC endpoint returning one of these statuses is sufficient. The attacker does not need to defeat any mitigation or race a specific window — the bug is that the code path doesn't exist at all.
- PR:N — no privileges required.
- UI:N — no user interaction.
- C:N — no confidentiality impact.
- I:H — downstream integrity decisions are taken on non-broadcast transactions.
- A:N — no availability impact.
Affected versions
The ARC broadcaster was introduced in commit a1f2e62 ("feat(network): add ARC broadcaster with injectable HTTP client") on 2026-02-08 and first released in v0.1.0. The narrow failure predicate has been present since introduction. Every release up to and including v0.8.1 is affected.
Affected range: >= 0.1.0, < 0.8.2.
Patches
Upgrade to bsv-sdk >= 0.8.2. The fix:
- Expands the failure predicate (
REJECTED_STATUSES+ORPHANsubstring check on bothtxStatusandextraInfo) to includeINVALID,MALFORMED,MINED_IN_STALE_BLOCK, and any orphan-containing response, matching the TypeScript reference. - Switches
Content-Typetoapplication/jsonwith a{ rawTx: <hex> }body, preferring Extended Format (BRC-30) hex when every input hassource_satoshisandsource_locking_scriptpopulated and falling back to plain raw-tx hex otherwise. - Adds support for the
XDeployment-ID(default: randombsv-ruby-sdk-<hex>),X-CallbackUrl, andX-CallbackTokenheaders via new constructor keyword arguments.
Fixed in sgbett/bsv-ruby-sdk#306.
Note for bsv-wallet consumers
The sibling gem bsv-wallet (published from the same repository) is not independently vulnerable — lib/bsv/network/arc.rb is not bundled into the wallet gem's files list. However, bsv-wallet runtime-depends on bsv-sdk, so a consumer of bsv-wallet that also invokes the ARC broadcaster is transitively exposed whenever Gemfile.lock resolves to a vulnerable bsv-sdk version. bsv-wallet >= 0.3.4 tightens its bsv-sdk constraint to >= 0.8.2, < 1.0, so upgrading either gem is sufficient to pull in the fix.
Workarounds
If upgrading is not immediately possible:
- Verify broadcast results out-of-band (e.g. query a block explorer or WhatsOnChain) before treating a transaction as broadcast.
- Do not gate integrity-critical actions solely on the ARC broadcaster's success response.
Credit
Identified during the 2026-04-08 cross-SDK compliance review, tracked as finding F5.13.
References
- HLR: sgbett/bsv-ruby-sdk#305
- Fix PR: sgbett/bsv-ruby-sdk#306
- Compliance review:
.architecture/reviews/20260408-cross-sdk-compliance-review.md - TypeScript reference:
ARCclass in@bsv/sdk
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 💎RubyGems | bsv-sdk | ≥ 0.1.0&&< 0.8.2 | 0.8.2bundle update bsv-sdk --conservative |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for bsv-sdk, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update bsv-sdk to 0.8.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-40069 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2026-40069 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2026-40069. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-40069 in your dependencies?
O3 Security finds CVE-2026-40069 across RubyGems dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.