CVE-2026-15432

The CVE concerns Tink-Java and Tink-Android’s ChunkedMacVerification: during tag verification, the implementation uses a non-constant-time comparison, enabling a timing side-channel that could reveal how many bytes of a given tag match the correct tag. This is described as a potential pathway for...

CVE-2026-15432 Observable Timing Discrepancy in Tink-Java and Tink-Android ChunkedMacVerification

When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in...

CVE-2026-15432 Observable Timing Discrepancy in Tink-Java and Tink-Android ChunkedMacVerification

When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in...

androidx.health:health-services-client (>=1.0.0-alpha02, <=1.0.0-alpha03), androidx.security:security-crypto (1.0.0-rc01) +76 more potentially affected by CVE-2022-3510 via com.google.protobuf:protobuf-javalite (>=3.8.0, <=3.15.5)

com.google.protobuf:protobuf-javalite MAVEN version =3.8.0, =1.0.0-alpha02, =1.1.18, =1.1, =2.15.3unofficial1, =2.15.3unofficial1, =0.2.35-snapshot, =1.3.0-rc2, =21.5.0, =25.1.2 and more Source cves: CVE-2022-3510 Source advisory: MEND:CVE-2022-3510...