{"id":"CVE-2026-40583","summary":"UltraDAG: SmartOp Vote Path Triggers Fatal Supply Invariant Halt","details":"UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails authorization only after state mutation has already occurred.","aliases":["GHSA-q8wx-2crx-c7pp"],"modified":"2026-07-15T01:49:04.870185850Z","published":"2026-04-21T16:57:42.100Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40583.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-460","CWE-696"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40583.json"},{"type":"ADVISORY","url":"https://github.com/UltraDAGcom/core/security/advisories/GHSA-q8wx-2crx-c7pp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40583"},{"type":"FIX","url":"https://github.com/UltraDAGcom/core/commit/2f5a3a237ea519b48d71e6e3093c89f60694c7be"},{"type":"FIX","url":"https://github.com/UltraDAGcom/core/commit/45bcf7064741897319b6196d3d9f9e1307093511"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ultradagcom/core","events":[{"introduced":"3b0589a20bc3afebed861f664ceb6167a6785770"},{"fixed":"2f5a3a237ea519b48d71e6e3093c89f60694c7be"},{"fixed":"45bcf7064741897319b6196d3d9f9e1307093511"}],"database_specific":{"source":["CPE_STRING","REFERENCES"],"cpe":"cpe:2.3:a:ultradag:ultradag:0.1.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0.1.0"},{"last_affected":"0.1.0"}]}}],"versions":["0.1.0","= 0.1","latest","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40583.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/U:Red"}]}