Vulnerability Description
When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in turn could allow to find a correct tag bytewise.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-15432?
CVE-2026-15432 is a documented vulnerability. When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side c...
How severe is CVE-2026-15432?
CVSS scoring is not yet available for CVE-2026-15432. Check NVD for updates.
Is there a patch for CVE-2026-15432?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.