What’s Vulnerable › Vulnerabilities

CVE-2019-7167

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-03-27 · updated 2026-06-17
• Weakness: CWE-754

Description

Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability. A key-generation process, during evaluation of polynomials related to a to-be-proven statement, produced certain bypass elements. Availability of these elements allowed a cheating prover to bypass a consistency check, and consequently transform the proof of one statement into an ostensibly valid proof of a different statement, thereby breaking the soundness of the proof system. This misled the original Sprout zk-SNARK verifier into accepting the correctness of a transaction.

Affected products

• Z.Cash Zcash: through 2.0.1

References

• http://fortune.com/2019/02/05/zcash-vulnerability-cryptocurrency/
• https://github.com/JinBean/CVE-Extension
• https://z.cash/blog/zcash-counterfeiting-vulnerability-successfully-remediated/
• http://fortune.com/2019/02/05/zcash-vulnerability-cryptocurrency/
• https://github.com/JinBean/CVE-Extension
• https://z.cash/blog/zcash-counterfeiting-vulnerability-successfully-remediated/

Get alerted when CVE-2019-7167 or the next vulnerability affects your stack