This page lists known issues in Tink, sorted by language version:

- [Java (excluding Android)](https://developers.google.com/tink/known-issues#java_excluding_android)
- [Android](https://developers.google.com/tink/known-issues#android)
- [C++](https://developers.google.com/tink/known-issues#c)
- [Python](https://developers.google.com/tink/known-issues#python)
- [Go](https://developers.google.com/tink/known-issues#go)
- [Objective-C](https://developers.google.com/tink/known-issues#objective-c)

Follow the links in the tables for more information on individual known issues.

> [!NOTE]
> **Note:** To report an issue or view recent reports from other users, go to the affected repository on [GitHub](https://github.com/tink-crypto/).

## Java (excluding Android)

Tink Java uses an underlying security provider, like Conscrypt, Oracle JDK,
OpenJDK, or Bouncy Castle. Any security issue in a provider may be inherited in
Tink Java.

We recommend using Tink with the latest version of the provider, especially if
you use ECDSA (alternative: ED25519) or AES-GCM (alternatives: AES-EAX,
AES-CTR-HMAC-AEAD or XChaCha20-Poly1305).

| Known Issue | Affected Versions |
|---|---|
| [Streaming AEAD: Integer overflow](https://developers.google.com/tink/issues/streaming-aead-overflow) | 1.0.0 - 1.3.0 |
| [Envelope AEAD: Malleability](https://developers.google.com/tink/issues/envelope-aead-malleability) | All |
| [Fork Safety](https://developers.google.com/tink/issues/fork-safety) | All |

## Android

On Android, Tink uses the Conscrypt provided by GMS core by default, and
Conscrypt otherwise. Any security issue in a provider may be inherited in Tink.

We recommend using Tink with the latest version of the provider.

The lowest supported Android version is described in on the
[Setup page](https://developers.google.com/tink/setup/java#tink-android).

| Known Issue | Affected Tink Versions | Affected Android API levels |
|---|---|---|
| [Streaming AEAD: Integer overflow](https://developers.google.com/tink/issues/streaming-aead-overflow) | 1.0.0 - 1.3.0 | All |
| [Envelope AEAD: Malleability](https://developers.google.com/tink/issues/envelope-aead-malleability) | All | All |
| [Fork Safety](https://developers.google.com/tink/issues/fork-safety) | All | All |

## C++

Tink C++ uses either BoringSSL or OpenSSL as an underlying library. Any security
issue in the underlying library may be inherited in Tink C++.

| Known Issue | Affected Versions |
|---|---|
| [JSON Parsing DoS](https://developers.google.com/tink/issues/CVE-2024-4420) | 1.0.0 - 2.1.3 |
| [Subtle AEAD: AES-CTR-HMAC and EncryptThenAuthenticate](https://developers.google.com/tink/issues/subtle-aead-cpp) | 1.0.0 - 1.3.0 |
| [Envelope AEAD: Malleability](https://developers.google.com/tink/issues/envelope-aead-malleability) | All |
| [Fork Safety](https://developers.google.com/tink/issues/fork-safety) | All |

## Python

Tink Python is a wrapper around Tink C++ using pybind11. Any security issue in
Tink C++ may be inherited in Tink Python.

| Known Issue | Affected Versions |
|---|---|
| [Envelope AEAD: Malleability](https://developers.google.com/tink/issues/envelope-aead-malleability) | All |
| [Fork Safety](https://developers.google.com/tink/issues/fork-safety) | All |

## Go

Tink Go uses the underlying Go crypto libraries. Any security issues in those
libraries may be inherited by Tink Go.

| Known Issue | Affected Versions |
|---|---|
| [Streaming AEAD: Integer overflow](https://developers.google.com/tink/issues/streaming-aead-overflow) | 1.0.0 - 1.3.0 |
| [Envelope AEAD: Malleability](https://developers.google.com/tink/issues/envelope-aead-malleability) | All |
| [Fork Safety](https://developers.google.com/tink/issues/fork-safety) | All |

## Objective-C

Tink Objective-C is a wrapper around Tink C++. Any security issue in Tink C++
may be inherited in Tink Objective-C.

| Known Issue | Affected Versions |
|---|---|
| [Envelope AEAD: Malleability](https://developers.google.com/tink/issues/envelope-aead-malleability) | All |
| [Fork Safety](https://developers.google.com/tink/issues/fork-safety) | All |