CVE-2026-15432
8.2
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Summary
When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in turn could allow to find a correct tag bytewise.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Tink-Java | All releases before 1.21.0, including 1.21.0. | affected | |
| Tink-Android | All releases before 1.21.0, including 1.21.0. | affected |
Weaknesses
- CWE-208: CWE-208 Observable Timing Discrepancy
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.