CVE-2026-100836

MEDIUM 4.3

Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a short base64-encoded ciphertext, causing log spam and request failures without crashing the process.

CWE	CWE-129
Vendor	edgelesssys
Product	contrast
Published	Sep 27, 2026

Stay Ahead of the Next One

Get instant alerts for edgelesssys contrast

Be the first to know when new medium vulnerabilities affecting edgelesssys contrast are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

edgelesssys / contrast

0 ≤ 1.20.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/edgelesssys/contrast/security/advisories/GHSA-3ccm-4qq2-5wrp vulncheck.com: https://www.vulncheck.com/advisories/edgeless-systems-contrast-through-1.20.0-denial-of-service-via-ciphertextcontainer