CVE-2026-15432: google tink_java Observable Timing Discrepancy

Vulnerability summary

CVE-2026-15432 is a high (CVSS 8.2) Observable Timing Discrepancy vulnerability in google tink_java. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 5.2% of scored vulnerabilities.

Timeline

1. 21-07-2026
   PublishedVulnerability first disclosed.
2. 22-07-2026
   Last modifiedVulnerability information updated.

Description

When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in turn could allow to find a correct tag bytewise.

• CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.