The vulnerability arises from the use of a non-constant time comparison when verifying MAC tags with the ChunkedMacVerification object in Google Tink-Java. This timing side channel (CWE-208) allows an attacker to observe timing differences that reveal partial information about the correctness of the tag bytes. Such information leakage can facilitate an attacker in reconstructing the valid MAC tag byte by byte. The CVSS 4.0 score is 8.2, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on integrity.

An attacker can exploit the timing discrepancy to gain partial information about the MAC tag, potentially allowing them to forge or guess valid tags by analyzing timing side channels. This undermines the integrity guarantees of the cryptographic verification process in Tink-Java. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor Google’s advisories for updates and apply patches once available.