Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertexts in github.com/edgelesssys/contrast

GO-2026-5864 · GHSA-3ccm-4qq2-5wrp

Published Jul 7, 2026 · Modified Jul 7, 2026

Description

Constrata's coordinator transit engine ciphertextContainer.UnmarshalJSON panics on attacker-controlled short ciphertexts in github.com/edgelesssys/contrast

References

ADVISORY https://github.com/edgelesssys/contrast/security/advisories/GHSA-3ccm-4qq2-5wrp
FIX https://github.com/edgelesssys/contrast/commit/d6584fbff816037472034f7ad6e08cdbab1d870d
WEB https://github.com/edgelesssys/contrast/releases/tag/v1.21.0

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes