7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40069

CVE-2026-40069: bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts

BSV Ruby SDK is the Ruby SDK for the BSV blockchain. From 0.1.0 to before 0.8.2, BSV::Network::ARC's failure detection only recognises REJECTED and DOUBLE_SPEND_ATTEMPTED. ARC responses with txStatus values of INVALID, MALFORMED, MINED_IN_STALE_BLOCK, or any ORPHAN-containing extraInfo / txStatus are silently treated as successful broadcasts. Applications that gate actions on broadcaster success are tricked into trusting transactions that were never accepted by the network. This vulnerability is fixed in 0.8.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40069

CVE-2026-40069:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
bsv-sdk	rubygems	>= 0.1.0, < 0.8.2	0.8.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the bsv-sdk gem's ARC broadcaster component, which is responsible for submitting transactions to the Bitcoin SV network via an ARC server. The root cause is an incomplete failure detection mechanism in the BSV::Network::ARC.rejected_status? method. This method only checked for two specific failure statuses (REJECTED and DOUBLE_SPEND_ATTEMPTED), while the ARC specification includes several others, such as INVALID, MALFORMED, and statuses indicating an ORPHAN transaction.

When a transaction is submitted using BSV::Network::ARC.broadcast, the ARC server might reject it with one of these unhandled statuses. The rejected_status? function would incorrectly return false, leading the handle_broadcast_response function to treat the failure as a success. Consequently, the broadcast method returns a success object to the application.

This flaw could trick an application into believing a transaction was successfully broadcast and accepted by the network when it was actually rejected. This could lead to severe integrity issues, such as releasing goods or marking an invoice as paid based on a transaction that never occurred. The patch addresses this by expanding the list of REJECTED_STATUSES and adding logic to detect ORPHAN transactions by checking the txStatus and extraInfo fields of the ARC response, ensuring all failure modes are correctly identified and handled by raising an error.

Vulnerable functions

BSV::Network::ARC.broadcast

lib/bsv/network/arc.rb

This is the main public method used to broadcast a transaction. It calls `handle_broadcast_response` to process the result. An application would call this function and receive a misleading success response for a failed transaction broadcast (e.g., one that is `INVALID` or `ORPHAN`) due to the incomplete failure checks in its helper methods.

BSV::Network::ARC.handle_broadcast_response

lib/bsv/network/arc.rb

This function is responsible for interpreting the HTTP response from the ARC server. The vulnerability is triggered within this function because it calls the flawed `rejected_status?` method. When `rejected_status?` incorrectly returns `false` for a failed status, this function proceeds to call `build_response(body)`, which constructs a success object, instead of raising a `BroadcastError`.

BSV::Network::ARC.rejected_status?

lib/bsv/network/arc.rb

This function contains the root cause of the vulnerability. Its logic for detecting a failed transaction was incomplete. The original implementation only checked for 'REJECTED' and 'DOUBLE_SPEND_ATTEMPTED' statuses, ignoring other critical failure statuses like 'INVALID', 'MALFORMED', 'MINED_IN_STALE_BLOCK', or any status indicating an 'ORPHAN' transaction. This caused its calling function, `handle_broadcast_response`, to misinterpret the transaction's actual status.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.