Skip to main content

Improper Handling of Unicode Encoding


Severity Medium
Score 5.3/10


A mis-handling of invalid unicode characters in the Java implementation of Tink versions prior to 1.5 allows an attacker to change the ID part of a ciphertext, which result in the creation of a second ciphertext that can decrypt to the same plaintext. This can be a problem with encrypting deterministic AEAD with a single key, and rely on a unique ciphertext-per-plaintext.

  • LOW
  • LOW
  • NONE
  • NONE
  • NONE
  • NONE

CWE-176 - Improper Handling of Unicode Encoding

The software does not properly handle when an input contains Unicode encoding.


Advisory Timeline

  • Published