CVE-2020-8929

CVE-2020-8929 concerns the Java implementation of Google Tink prior to 1.5, where mis-handling invalid Unicode characters in ciphertexts allows an attacker to change the ID portion of a ciphertext. This can create a second ciphertext that decrypts to the same plaintext, impacting ciphertext integ...

CVE-2026-15432

The CVE concerns Tink-Java and Tink-Android’s ChunkedMacVerification: during tag verification, the implementation uses a non-constant-time comparison, enabling a timing side-channel that could reveal how many bytes of a given tag match the correct tag. This is described as a potential pathway for...