CVE-2026-109425

Name of the Vulnerable Software and Affected Versions Tink-go versions prior to 2.8.1

Description An input-validation issue exists where the functions NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle. This allows malformed public or no-secret keysets that violate internal invariants to be accepted. An attacker can provide a malformed keyset, such as one containing an enabled public key without a valid primary key or a DESTROYED key lacking KeyData. This leads to inconsistent downstream validation, as functions like JWKSetFromPublicKeysetHandle() may process the invalid handle and produce a JWK set, potentially misleading applications that assume successful handle construction ensures keyset integrity.

Recommendations Update to a version newer than 2.8.0. As a temporary mitigation, restrict the use of NewHandleWithNoSecrets() and ReadWithNoSecrets() functions until the update is applied.