CVE-2026-35679 LOW

CVE-2026-35679

Vendor Zcash

Product zcashd

Weakness CWE-358

Published April 5, 2026

Last update April 6, 2026

View on NVD All CVEs

CVSS base score

3.5/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

What the vulnerability does

01Description

Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool. It was sometimes not verifying Sprout proofs.

Key dates

02Disclosure timeline

April 5, 2026 CVE published

April 6, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-35679 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/358.html

Related vulnerabilities

04Related CVE

CVE-2021-34791 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Application Level Gateway Bypass Vulnerabilities CVE-2025-69234 CVE-2021-34790 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Application Level Gateway Bypass Vulnerabilities CVE-2017-2604 CVE-2025-31983 HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header