Contrast versions up to 1.20.0 contain a medium severity vulnerability (CVE-2026-100836) in the transit-engine endpoint's ciphertextContainer.UnmarshalJSON function. The flaw is due to improper validation of the length of decoded ciphertext before slicing, which can cause a runtime panic. An authenticated workload with a valid mesh certificate can exploit this by submitting a short base64-encoded ciphertext, resulting in log spam and request failures. The process does not crash, and no confidentiality or integrity impact is reported.