CVE-2024-4420 is a High (CVSS 7.5) denial of service in Google Tink for C++ before version 2.1.3. Crafted JSON passed to JsonKeysetReader can crash a program, either because it is not an object or because it is deeply nested. Upgrade tink-cc to 2.1.3 or later.
What's affected
- Product: Google Tink for C++ (tink-cc), versions before 2.1.3.
- Affected class: crypto::tink::JsonKeysetReader.
- Fixed version: 2.1.3. Both the record and the GitHub issue I read say the problems are fixed in 2.1.3. The issue names two commits, da091f8 and dfbbe8f.
- Severity: High, CVSS 7.5, with no privileges, no user interaction and availability impact only.
- Two triggers: input that is valid JSON but not an object (a number or an array), and input with many nested objects that may overflow the stack.
- Exploitation: KEV is false.
How to check if you're exposed
Tink C++ is a library, so the version lives in your build files. Look in your Bazel, CMake or package manager configuration for tink-cc and check the pinned version or commit.
Then ask the real question: do you pass untrusted JSON to JsonKeysetReader? Keysets normally come from your own secure storage. If an outsider can supply a keyset, as in an upload feature or a request body, your exposure is real. Otherwise the practical risk is lower.
What to do now
- Find tink-cc in your build files and read the version.
- Upgrade to 2.1.3 or later and rebuild.
- Search your code for JsonKeysetReader and trace where its input comes from.
- Reject keyset input from untrusted sources, and cap input size before parsing.
- Rebuild and redeploy every binary that statically links the old version.
Why it matters
The record maps this to CWE-116, improper encoding or escaping of output. The weakness the project describes is a parsing assumption. The reader assumed any valid JSON was an object, and did not limit nesting depth.
The result is a crash rather than data theft, so the score is about availability. For a service that handles many requests, one crashing input can take it down repeatedly, which is why the rating is High.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Tink version fixes it?
2.1.3, per the record and the project's GitHub issue.
Is my app exposed if keysets come from a vault?
Much less so. The risk is mainly where untrusted parties can supply the JSON.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4420 (published 2024-05-21) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
