CVE-2026-100836 Details

A panic vulnerability has been identified in Edgeless Systems Contrast versions through 1.20.0. The issue resides in the transit-engine endpoint's 'ciphertextContainer.UnmarshalJSON' function, which improperly validates the length of decoded ciphertext before slicing. This vulnerability can be exploited by an authenticated workload with a valid mesh certificate, allowing it to send a short base64-encoded ciphertext. The resulting runtime panic causes log spam and request failures, creating a soft denial-of-service condition on the transit-engine endpoint without crashing the Coordinator process.

To address this vulnerability, the 'UnmarshalJSON' function should be modified to validate the length of the decoded ciphertext before slicing. The recommended change is to check that the ciphertext is at least 12 bytes long before extracting the nonce. Additionally, a unit test should be added to ensure that the function correctly handles short ciphertexts by returning a structured error instead of panicking.