CVE-2026-40069

OVERVIEW CVE-2026-40069 affects the BSV Ruby SDK versions 0.1.0 through 0.8.1, a blockchain development library for the BSV network. The vulnerability exists in the ARC (Merkle Network's transaction status API) failure detection mechanism, which fails to properly recognize multiple transaction rejection statuses. Specifically, the SDK treats responses indicating INVALID, MALFORMED, MINED_IN_STALE_BLOCK, and ORPHAN transactions as successful broadcasts, when they should be flagged as failures. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no privileges or user interaction. The primary impact is integrity compromise, as applications relying on the SDK's broadcast success confirmation may incorrectly trust transactions that were never accepted by the network. This creates downstream operational risk where transaction-dependent actions are executed based on false assumptions about blockchain acceptance. EXPLOITATION STATUS There is no indication of active exploitation, with the vulnerability absent from CISA's Known Exploited Vulnerabilities catalog and classified as inactive on vulnerability tracking platforms. The EPSS score of 0.00041 suggests minimal real-world exploitation probability currently. The vulnerability was remediated in version 0.8.2, and community awareness appears limited given the specialized nature of blockchain SDK usage.