CVE-2026-100836

Published: Set 27, 2026 Last Modified: Set 28, 2026

ExploitDB:

Other exploit source:

Google Dorks:

MEDIUM 5,3

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: low

User Interaction: none

Confidentiality: N/A

Integrity: N/A

Availability: N/A

MEDIUM 4,3

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: low

User Interaction: none

Scope: unchanged

Confidentiality: none

Integrity: none

Availability: low

Description

AI Translation Available

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a short base64-encoded ciphertext, causing log spam and request failures without crashing the process.

129

Improper Validation of Array Index

Draft

Abstraction: Variant Structure: Simple

Common Consequences

Security Scopes Affected:

Integrity Availability Confidentiality

Potential Impacts:

Dos: Crash, Exit, Or Restart Modify Memory Read Memory Execute Unauthorized Code Or Commands

Applicable Platforms

Languages: C, C++, Not Language-Specific

Likelihood of Exploit: High

View CWE Details

https://github.com/edgelesssys/contrast/security/advisories…

https://github.com/edgelesssys/contrast/security/advisories/GHSA-3ccm-4qq2-5wrp