CVE-2026-109425
Description
A flaw was found in tink-go. Keyset creation functions fail to perform structural validation before constructing a keyset handle, allowing malformed public or secret-free keysets to be accepted. A remote attacker can exploit this flaw by providing a crafted keyset that violates cryptographic keyset integrity rules. Consequently, downstream components may process the invalid keyset as legitimate, potentially compromising application security logic that relies on keyset validation.
Statement
This vulnerability is rated as Moderate because the flaw only impacts integrity validation of public or secretless keysets, without exposing private cryptographic key material or causing a denial of service. Applications are susceptible primarily if they consume untrusted external keysets and assume that handle initialization guarantees structural correctness. In typical Red Hat deployments, cryptographic operations rarely ingest unvalidated keyset structures from untrusted network sources directly, limiting the exposure to specific downstream workflows.
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
When complex inputs are inconsistent, attackers could trigger unexpected errors, cause incorrect actions to take place, or exploit latent vulnerabilities.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
