CVE-2026-15432: Observable Timing Discrepancy in Tink-Java and Tink-Android ChunkedMacVerification
When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in turn could allow to find a correct tag bytewise.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15432?
CVE-2026-15432 has a high severity rating of 8.2 according to the CVSS scoring system.
How do I fix CVE-2026-15432?
To fix CVE-2026-15432, update to the latest version of Tink-Java or Tink-Android where the issue has been addressed.
What does CVE-2026-15432 vulnerability affect?
CVE-2026-15432 affects the ChunkedMacVerification feature in Tink-Java and Tink-Android libraries.
What are the potential risks of CVE-2026-15432?
The potential risks of CVE-2026-15432 include allowing attackers to exploit timing discrepancies to gain information about valid MAC tags.
When was CVE-2026-15432 published?
CVE-2026-15432 was published on July 21, 2026.