Junglewise Threat Intelligence

Edgeless Systems Contrast panic in transit engine UnmarshalJSON

Severity: medium · CVSS 4.3 · Published 2026-07-01

Technologies: Edgeless Systems Contrast, github.com/edgelesssys/contrast (Go). Vendors: Edgeless Systems, Go.

Executive brief

A vulnerability in the Constrata coordinator transit engine allows an authenticated user to cause the service to crash internally by sending a specially crafted, short encrypted message. While the service automatically recovers from these crashes, an attacker can repeatedly trigger this behavior to flood system logs and degrade performance. This results in a minor service disruption and makes it harder for administrators to monitor legitimate system activity.

Technical details

A slice bounds out-of-range panic exists in the `ciphertextContainer.UnmarshalJSON` function within `coordinator/internal/transitengineapi/crypto.go`. The root cause is a lack of length validation on the decoded base64 ciphertext before attempting to extract a 12-byte AES-GCM nonce. An authenticated attacker with a valid mesh certificate can provide a ciphertext shorter than 12 bytes to trigger a Go runtime panic. While the `net/http` recovery mechanism prevents a full process crash, the panic results in a 500 error, connection termination, and the leakage of internal stack traces into the logs. This can be leveraged for log-based denial of service and version fingerprinting. The issue is addressed in version 1.21.0 by adding explicit length checks.

Affected products

  • edgelesssys contrast <= 1.20.0

Timeline

  • 2026-05-27: disclosed
  • 2026-07-01: advisory

References

Related threats