CVE-2026-81515: Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, EurekaDiscoveryClient deserializes the registry response as one unit, and an unrecognized actionType or status, a non-Boolean isCoordinatingDiscoveryServer, or a nonnumeric timestamp can abort the entire response. A principal that can register or update an instance can cause all connected Steeltoe clients to receive an empty or stale instance list until the malformed registration is removed. The JsonInstanceInfoConverter, BoolStringJsonConverter, and LongStringJsonConverter parsing paths are affected. This issue is distinct from the earlier DataCenterInfo.name parsing vulnerability. This issue is fixed in version 4.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Steeltoe.Discovery.Eurekato a version that resolves this vulnerability.Fixed in 4.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A principal that can register or update an instance in Eureka can introduce malformed registration data. No access to the affected Steeltoe clients themselves is required beyond the ability to place that malformed instance in the registry.
Are all Steeltoe versions affected?
The affected range is Steeltoe 4.0.0 through versions before 4.3.0. Version 4.3.0 fixes the issue.
What is the operational impact on connected clients?
A malformed actionType, status, isCoordinatingDiscoveryServer, or timestamp value can cause the registry response to fail as a whole. Connected Steeltoe clients can then operate with an empty or stale instance list until the malformed registration is removed.
What can be done if upgrading is not immediately possible?
Restrict who can register or update Eureka instances, and remove registrations containing unrecognized actionType or status values, non-Boolean isCoordinatingDiscoveryServer values, or nonnumeric timestamps. This prevents malformed instance data from aborting registry fetches.