Google Tink Java vulnerabilities

2 CVEs affecting Google Tink Java, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-15432, published 2026-07-21.

More from Google.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-8929, published 2020-10-19. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. A mis-handling of invalid unicode characters in the Java implementation of Tink versions prior to 1.5 allows an attacker to change the ID part of a ciphertext, which result in the creation of a…
• CVE-2026-15432, published 2026-07-21. Medium severity, CVSS 5.9. EPSS: 0.2% chance of exploitation in the next 30 days. When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side…