Edgeless Contrast CVE-2026-100836

Requires an authenticated caller that holds a valid mesh certificate for any WorkloadSecretID and network reach to the Contrast Coordinator's transit-engine endpoint (versions through 1.20.0). The specific trigger is submitting a 'vault:vX:base64' ciphertext whose third component base64-decodes to fewer than 12 bytes (any base64 string shorter than ~16 characters). No user interaction and no special non-default configuration are needed beyond the transit-engine being in use. Limiting factors: the mesh-certificate authentication requirement (PR:L), and the fact that the panic is recovered by net/http so the process survives - impact is confined to log spam, failed requests, and endpoint degradation rather than a hard crash or data compromise.

This is a genuinely low-priority availability-only issue despite being reachable over the network. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L, 5.3) is internally consistent with the advisory: the impact is limited (VA:L) because the panic is recovered by net/http's handler goroutine - the Coordinator process does NOT crash, it returns a 500 and continues. The realistic outcome is log spam, elevated request-failure metrics, and a 'slow but cheap' degradation of the transit-engine endpoint, not a full outage. Exploitation requires an authenticated workload holding a valid mesh certificate (PR:L), which meaningfully raises the bar over a truly unauthenticated DoS. No EPSS score, no CISA KEV listing, and no independent POC are provided, though the GHSA advisory itself contains the exact triggering mechanics (a short base64 ciphertext), effectively serving as a proof of concept. No SSVC decision block was supplied. There is no signal of active exploitation. Bottom line: a real but minor DoS gated behind authentication with self-healing impact - patch on normal cadence, not an emergency. Note the input tag 'Denial Of Service' is accurate here, unlike some sibling Contrast CVEs whose tags were mislabeled.

An authenticated workload with a valid mesh certificate for any WorkloadSecretID sends a crafted request to the transit-engine endpoint containing a 'vault:vX:base64' ciphertext whose base64 component decodes to fewer than 12 bytes. During JSON parsing, ciphertextContainer.UnmarshalJSON slices the too-short buffer to extract the 12-byte AES-GCM nonce, triggering a Go runtime slice-bounds panic that is recovered to a 500 response. Repeating this cheaply produces sustained log spam and request failures against the Coordinator; the GHSA advisory documents the exact panicking code path.