Timing Attack Vulnerability in Tink Java Cryptography Library

CVE-2026-15432

What is CVE-2026-15432?

A timing attack vulnerability exists in the Tink Java Cryptography Library when verifying a MAC using a ChunkedMacVerification object. The library's non-constant time comparison method allows attackers to potentially exploit timing discrepancies to infer how many bytes of a given tag match the valid tag. This side-channel information could enable attackers to reconstruct the correct tag byte-by-byte, posing a significant risk to the integrity of cryptographic operations.

References