CVE-2026-15432
Received Received - Intake

Tink ChunkedMacVerification Timing Side Channel Vulnerability

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Google Inc.

Description
When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in turn could allow to find a correct tag bytewise.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-15432
EUVD
EUVD-2026-46318

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
google tink-java to 1.21.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-208 Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a timing side-channel in the tink-java library's ChunkedMacVerification class. When verifying a MAC tag, the library uses a non-constant-time comparison, which leaks timing information about how many bytes of a given tag match the correct one. This allows attackers to potentially reconstruct the correct tag byte by byte through timing analysis.

Detection Guidance

To detect this vulnerability, check the version of the tink-java library in use. If it is below 1.21.0, the system is potentially vulnerable. Run commands like 'mvn dependency:tree' for Maven projects or 'gradle dependencies' for Gradle projects to inspect the library version.

Impact Analysis

If you use tink-java versions prior to 1.21.0, an attacker could exploit this to recover MAC tags used for data integrity verification. This could lead to unauthorized data tampering or forgery if the MAC is used to protect sensitive information. The impact depends on how the library is used in your application.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling timing side-channel attacks that may expose sensitive data during cryptographic operations. Non-constant-time comparisons in MAC verification could lead to unauthorized data disclosure, violating confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade the tink-java library to version 1.21.0 or later. This version includes the fix for the constant-time verification issue in the ChunkedMacVerification class.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15432. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart