CVE-2026-100836 Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer
Authenticated attackers can trigger a runtime panic in the transit-engine endpoint by submitting malformed ciphertext, causing service disruption.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100836?
CVE-2026-100836 is a medium-severity denial of service vulnerability in edgelesssys contrast, published on 27 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a short base64-encoded ciphertext, causing log spam and request failures without crashing the process.
Weakness: CWE-129
Which versions are affected by CVE-2026-100836?
3 open source packages ship an affected version, including github.com/edgelesssys/contrast.
| Package | Affected | Fixed in |
|---|---|---|
github.com/edgelesssys/contrast Go | All versions | 1.21.0 |
github.com/edgelesssys/contrast Go | All versions | 1.21.0 |
github.com/edgelesssys/contrast Go | All versions | 1.21.0 |
How do I fix CVE-2026-100836?
Upgrade github.com/edgelesssys/contrast to 1.21.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-100836 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100836 exists.
Sources
Also known as GHSA-3ccm-4qq2-5wrp, GHSA-x66w-59x9-vvcf, GO-2026-5864.