Vulnerability Details CVE-2026-15432
When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in turn could allow to find a correct tag bytewise.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 5.3%
CVSS Severity
CVSS v3 Score 5.9
Products affected by CVE-2026-15432
-
cpe:2.3:a:google:tink_java:1.0.0
-
cpe:2.3:a:google:tink_java:1.1.0
-
cpe:2.3:a:google:tink_java:1.1.1
-
cpe:2.3:a:google:tink_java:1.10.0
-
cpe:2.3:a:google:tink_java:1.11.0
-
cpe:2.3:a:google:tink_java:1.12.0
-
cpe:2.3:a:google:tink_java:1.13.0
-
cpe:2.3:a:google:tink_java:1.14.0
-
cpe:2.3:a:google:tink_java:1.14.1
-
cpe:2.3:a:google:tink_java:1.15.0
-
cpe:2.3:a:google:tink_java:1.16.0
-
cpe:2.3:a:google:tink_java:1.17.0
-
cpe:2.3:a:google:tink_java:1.18.0
-
cpe:2.3:a:google:tink_java:1.19.0
-
cpe:2.3:a:google:tink_java:1.2.0
-
cpe:2.3:a:google:tink_java:1.2.1
-
cpe:2.3:a:google:tink_java:1.2.2
-
cpe:2.3:a:google:tink_java:1.21.0
-
cpe:2.3:a:google:tink_java:1.3.0
-
cpe:2.3:a:google:tink_java:1.4.0
-
cpe:2.3:a:google:tink_java:1.5.0
-
cpe:2.3:a:google:tink_java:1.6.0
-
cpe:2.3:a:google:tink_java:1.6.1
-
cpe:2.3:a:google:tink_java:1.7.0
-
cpe:2.3:a:google:tink_java:1.8.0
-
cpe:2.3:a:google:tink_java:1.9.0