Back to CVE records
Low 3.5Published Apr 5, 2026
CVE-2026-35679Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool.
Updated under an hour ago ()
Does this affect you?
It affects zcashd. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool. It was sometimes not verifying Sprout proofs.
- CVSS
- 3.5 LOW (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
- Weakness (CWE)
- CWE-358
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- mitre
- NVD analysis
- Deferred
- Record last updated
- Apr 6, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Zcash zcashd zcash:zcashd (from the name) | before 6.12.0 | CNA record |
References
- https://github.com/zcash/zcash/releases/tag/v6.12.0
- https://github.com/zcash/zcash/commit/db969c63f48f0f9fc518112ed0b7ace1af78b9d0
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.