Source: golang-github-tink-crypto-tink-go X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerability was published for golang-github-tink-crypto-tink-go. CVE-2026-109425[0]: | Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input- | validation vulnerability where keyset.NewHandleWithNoSecrets() and | ReadWithNoSecrets() skip the structural Validate() step before | constructing a keyset.Handle, allowing malformed public or no-secret | keysets that violate Tink's keyset invariants to be accepted. | Attackers can supply a malformed keyset, such as one with an enabled | public key lacking a valid primary key or a DESTROYED key with no | KeyData, causing inconsistent downstream validation where functions | like jwt.JWKSetFromPublicKeysetHandle() process the invalid handle | and produce a JWK set, potentially misleading applications that rely | on successful handle construction as proof of keyset integrity. https://github.com/tink-crypto/tink-go/issues/68 If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-109425 https://www.cve.org/CVERecord?id=CVE-2026-109425 Please adjust the affected versions in the BTS as needed.
