Denial of Service Vulnerability in Tink-cc Prior to 2.1.3

CVE-2024-4420

What is CVE-2024-4420?

A Denial of Service vulnerability exists in Tink-cc, allowing adversaries to crash the software by feeding unexpected JSON inputs into the crypto::tink::JsonKeysetReader. This occurs when the input is a valid encoded JSON element that isn't an object—like a number or an array—prompting crashes as Tink expects valid JSON to always be an object. Additionally, inputs featuring multiple nested JSON objects can lead to stack overflows. To mitigate this risk, users are advised to upgrade to version 2.1.3 or higher.

References