CVE-2026-35679

Published: Apr 5, 2026Modified: Jul 24, 2026Deferred

3.5

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Exploitability: 1.8 / Impact: 1.4

Source: MITRE (Secondary)

Description

Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool. It was sometimes not verifying Sprout proofs.

Related CWEs

CWE-358

Improperly Implemented Security Check for Standard

The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

References (2)

https://github.com/zcash/zcash/commit/db969c63f48f0f9fc518112ed0b7ace1af78b9d0

Source: cve@mitre.org

https://github.com/zcash/zcash/releases/tag/v6.12.0

Source: cve@mitre.org

Timeline

No history available yet.