CVE-2026-15432

MediumCVSS 5.9/10Last modified Sep 22, 2026

Description

When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in turn could allow to find a correct tag bytewise.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-208

Affected software

VendorProductVersions
GoogleTink-JavaAll releases before 1.21.0, including 1.21.0.
GoogleTink-AndroidAll releases before 1.21.0, including 1.21.0.

References

Timeline

Published
Jul 21, 2026
Last modified
Sep 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-154359.8IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories CVE-2026-154396.5The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integratioCVE-2026-15448.8A security flaw has been discovered in D-Link DIR-823X 250416. Impacted is the function sub_41E2A0 of the file /goform/set_mode. Performing CVE-2026-154415.3The WC Product Table Lite plugin for WordPress is vulnerable to CSS Injection in versions up to, and including, 5.6.0 via the 'laptop_scrollCVE-2026-154425.3In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutdown which couldCVE-2026-154444.9The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'coupon_code' paramCVE-2026-154454.9The SEO Booster plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and includCVE-2026-154466.4The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post ConCVE-2026-154486.5The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_order_status_filter' paraCVE-2026-154495.8A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC_GETMACPROP and DLDICVE-2026-15459.8A weakness has been identified in itsourcecode School Management System 1.0. The affected element is an unknown function of the file /courseCVE-2026-154508.1The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up