tink-crypto CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM tink-crypto CVE published 2026-10-12

CVE-2026-109425

CVE-2026-109425 Tink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecrets: Tink-go through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset invariants to be accepted.