{"id":"EUVD-2026-87831","enisaUuid":"bbd8f5ce-1e2e-3e26-b78d-37d1c8713b69","description":"Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint\u0027s ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a short base64-encoded ciphertext, causing log spam and request failures without crashing the process.","datePublished":"Sep 27, 2026, 1:29:58 AM","dateUpdated":"Sep 28, 2026, 4:00:49 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/edgelesssys/contrast/security/advisories/GHSA-3ccm-4qq2-5wrp\nhttps://www.vulncheck.com/advisories/edgeless-systems-contrast-through-1.20.0-denial-of-service-via-ciphertextcontainer\n","aliases":"CVE-2026-100836\nGHSA-x66w-59x9-vvcf\n","assigner":"VulnCheck","epss":0.18,"enisaIdProduct":[{"id":"5d742ff3-366b-3123-834a-e9fb6d8fc123","product":{"name":"contrast","vendor":{"name":"edgelesssys"}},"product_version":"0 ≤1.20.0"}],"enisaIdVendor":[{"id":"59b17529-4faa-35ab-9e62-40ffe7e0b8e1","vendor":{"name":"edgelesssys"}}],"enisaIdVulnerability":[{"id":"59434e87-6a25-3c75-873b-4186f4f85dc2","vulnerability":{"id":"GHSA-x66w-59x9-vvcf","description":"Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint\u0027s ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a short base64-encoded ciphertext, causing log spam and request failures without crashing the process.","datePublished":"Sep 27, 2026, 3:31:04 AM","dateUpdated":"Sep 27, 2026, 3:31:04 AM","baseScore":0.0,"references":"https://github.com/edgelesssys/contrast/security/advisories/GHSA-3ccm-4qq2-5wrp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-100836\nhttps://www.vulncheck.com/advisories/edgeless-systems-contrast-through-1.20.0-denial-of-service-via-ciphertextcontainer\n","enisa_id":"EUVD-2026-87831\n","aliases":"GHSA-x66w-59x9-vvcf\nCVE-2026-100836\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:54:29 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e6a5a160-1c44-3dce-8987-28c2df0942e1","vulnerability":{"id":"CVE-2026-100836","description":"Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint\u0027s ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a short base64-encoded ciphertext, causing log spam and request failures without crashing the process.","datePublished":"Sep 27, 2026, 1:29:58 AM","dateUpdated":"Sep 28, 2026, 4:00:49 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/edgelesssys/contrast/security/advisories/GHSA-3ccm-4qq2-5wrp\nhttps://www.vulncheck.com/advisories/edgeless-systems-contrast-through-1.20.0-denial-of-service-via-ciphertextcontainer\n","enisa_id":"EUVD-2026-87831\n","assigner":"VulnCheck","epss":0.18,"dataProcessed":"Nov 11, 2026, 7:20:34 AM","vulnerabilityProduct":[{"id":"c3e38093-facd-3b67-b045-dae9ea17da05","product":{"name":"contrast","vendor":{"name":"edgelesssys"}},"product_version":"0 ≤1.20.0"}],"vulnerabilityVendor":[{"id":"871e6a56-8793-3e9f-9751-855bc18510f5","vendor":{"name":"edgelesssys"}}]}}],"enisaIdAdvisory":[]}