The vulnerability arises from the use of a non-constant time comparison when verifying a MAC with the ChunkedMacVerification object in Google Tink-Java. This timing side channel (CWE-208) can leak information about the number of matching bytes in a tag, enabling an attacker to incrementally discover the correct MAC tag byte by byte. The CVSS 4.0 base score is 8.2, indicating high severity, with network attack vector, high attack complexity, no privileges required, and high impact on integrity. No patch or official remediation level has been provided by the vendor as of the published date.

An attacker can exploit timing differences during MAC verification to gain information about the correct tag, potentially allowing them to forge valid MACs by recovering the tag bytewise. This compromises the integrity guarantees provided by the MAC verification process in Tink-Java.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider mitigating timing side channels by implementing constant-time comparison functions for MAC verification or applying other cryptographic best practices to avoid timing leaks.