CVE-2026-35679

3.5 lowEPSS 0.2%

Low (3.5). EPSS 0.2% chance of exploitation in the next 30 days.

Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool. It was sometimes not verifying Sprout proofs.

Severity

CVSS 3.1

3.5 low

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-358
Published: 2026-04-05
Modified: 2026-07-24
Record from: the NVD, synced 2026-10-19

References

https://github.com/zcash/zcash/commit/db969c63f48f0f9fc518112ed0b7ace1af78b9d0
https://github.com/zcash/zcash/releases/tag/v6.12.0

Check your stack JSON