—

GO-2026-5864

Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertexts in github.com/edgelesssys/contrast

Details

Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertexts in github.com/edgelesssys/contrast

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/edgelesssys/contrast

Introduced in: 0 Fixed in: 1.21.0

Fix go get github.com/edgelesssys/contrast@v1.21.0

References

https://github.com/edgelesssys/contrast/security/advisories/GHSA-3ccm-4qq2-5wrp [ADVISORY]
https://github.com/edgelesssys/contrast/commit/d6584fbff816037472034f7ad6e08cdbab1d870d [FIX]
https://github.com/edgelesssys/contrast/releases/tag/v1.21.0 [WEB]