CVE-2026-15432 Overview
CVE-2026-15432 is a timing side-channel vulnerability in the Tink cryptographic library. When verifying a Message Authentication Code (MAC) using a ChunkedMacVerification object, Tink compares the computed tag against the expected tag using a non-constant-time comparison. The comparison leaks timing information proportional to the number of matching leading bytes. An attacker who can observe verification latency over the network can recover a valid MAC tag byte-by-byte. The weakness maps to [CWE-208: Observable Timing Discrepancy].
Critical Impact
Attackers can forge valid MAC tags by exploiting timing measurements, undermining the integrity guarantees provided by Tink's chunked MAC verification.
Affected Products
- Tink cryptographic library (tink-java)
- Applications invoking ChunkedMacVerification for MAC validation
- Downstream services relying on Tink for message integrity verification
Discovery Timeline
- 2026-07-21 - CVE-2026-15432 published to the National Vulnerability Database (NVD)
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-15432
Vulnerability Analysis
The defect resides in Tink's chunked MAC verification path. ChunkedMacVerification accumulates input in chunks and, on completion, compares the computed authentication tag against the supplied tag. The comparison exits early on the first mismatched byte instead of processing all bytes in constant time. The execution time therefore correlates with the length of the matching prefix between the attacker-supplied tag and the correct tag.
An adversary who can submit verification requests and measure response latency can iterate through candidate byte values for each tag position. Byte values that extend the matching prefix produce measurably longer verification times, revealing the correct byte before advancing to the next position. This reduces tag recovery from an exponential brute-force problem to a linear search across the tag length.
Root Cause
The root cause is the use of a data-dependent, short-circuiting byte comparison to validate the computed MAC tag inside ChunkedMacVerification. Cryptographic tag verification requires a constant-time comparator such as MessageDigest.isEqual in modern Java or an equivalent branchless routine. Without it, control-flow timing directly reflects secret-dependent comparison outcomes.
Attack Vector
Exploitation is network-reachable and requires no authentication or user interaction. The attacker submits a stream of MAC verification requests with crafted candidate tags and records timing telemetry from the responses. Statistical averaging over many trials filters network jitter and reveals the correct byte at each position. Once every byte is recovered, the attacker holds a valid MAC and can forge authenticated messages. Attack complexity is high because the adversary must collect enough samples to distinguish sub-microsecond timing differences over noisy channels.
The vulnerability mechanism is described in the GitHub Issue #75 Discussion.
Detection Methods for CVE-2026-15432
Indicators of Compromise
- Repeated MAC verification failures from a single source targeting the same message with incrementally varying tag bytes
- High-volume, low-latency requests to endpoints that invoke ChunkedMacVerification
- Statistical patterns in verification request payloads where only trailing tag bytes change between attempts
Detection Strategies
- Inspect application logs for bursts of MAC verification failures originating from the same client or subnet
- Instrument code paths that call ChunkedMacVerification.verifyMac() to emit metrics on failure rate and request cadence
- Alert on any client submitting more MAC verification attempts than the application's normal baseline within a rolling window
Monitoring Recommendations
- Rate-limit MAC verification endpoints and log rejected requests with client identifiers and payload hashes
- Correlate verification failures with network telemetry to detect timing-oracle probing patterns
- Track dependency versions of tink-java across the software bill of materials and flag hosts running vulnerable releases
How to Mitigate CVE-2026-15432
Immediate Actions Required
- Identify all services that depend on Tink and invoke ChunkedMacVerification for authentication tag validation
- Upgrade tink-java to a fixed release once published by the Tink maintainers
- Apply strict rate limits on endpoints that expose MAC verification to untrusted callers
Patch Information
No fixed version was recorded in the NVD entry at publication. Track the GitHub Issue #75 Discussion in the tink-crypto/tink-java repository for the remediation commit and release version.
Workarounds
- Replace calls to ChunkedMacVerification with the non-chunked Mac.verifyMac() API where feasible, and confirm the substitute uses constant-time comparison
- Wrap MAC verification with server-side jitter or fixed-latency response padding to blunt timing measurements until a patch is deployed
- Restrict MAC verification endpoints to authenticated internal callers and block direct exposure to the internet
# Example: enumerate Tink dependencies in a Maven project
mvn dependency:tree -Dincludes=com.google.crypto.tink | grep -i tink
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
