CVE-2026-100836

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a...

CVE-2026-100836 Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a...

EUVD-2026-87831

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a...

CVE-2026-100836 Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a...

CVE-2026-100836

Contrast through 1.20.0 is vulnerable to a Denial of Service (DoS) via a panic in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function. The root cause is a failure to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can...

CVE-2026-100836: Improper Validation of Array Index

Contrast through 1.20.0 contains a panic vulnerability in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function that fails to validate decoded ciphertext length before slicing. An authenticated workload with a valid mesh certificate can trigger a runtime panic by submitting a...

BIT-CONSUL-2026-15970 L7 intention authorization bypass via custom public listener

Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...

CVE-2026-15970

Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...

UBUNTU-CVE-2026-15970

Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...

PT-2026-69117

Name of the Vulnerable Software and Affected Versions Consul Community Edition versions 1.20.1 through 2.0.2 Consul Enterprise versions 1.20.1 through 2.0.2 Description An L7 intention authorization bypass exists when a service proxy is configured with a custom public listener. This allows an...

PT-2026-99456

Name of the Vulnerable Software and Affected Versions Contrast versions prior to 1.20.1 Description A panic occurs in the ciphertextContainer.UnmarshalJSON function within the 'transit-engine' endpoint. The issue arises because the function fails to validate the length of the decoded ciphertext...