CVE-2026-81516: Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, ConsulDiscoveryClient constructs ConsulServiceInstance objects by parsing each registration's secure metadata with a strict Boolean conversion. A principal that can register a Consul service can supply a secure value other than true or false, causing the exception from one instance to abort construction of the entire instance list and make the targeted service undiscoverable. When GetAllInstancesAsync enumerates all services, one malformed instance can abort enumeration across every service. The outage persists until the offending registration is removed. This issue is fixed in version 4.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Steeltoe.Discovery.Consulto a version that resolves this vulnerability.Fixed in 4.3.0 - Remove
Remove
Consul service registration with malformed 'secure' metadatafrom your environment.Remove the offending Consul service registration (the one with malformed 'secure' metadata) to restore service instance discovery; the outage persists until the registration is removed.
Event History
Frequently Asked Questions
Who can trigger the denial of service?
A principal that can register a Consul service can trigger it by supplying a secure metadata value other than true or false. No additional privileges or user interaction are required.
What operational impact can a malformed registration have?
It can cause construction of the entire instance list for a targeted service to fail, making that service undiscoverable. If GetAllInstancesAsync is used, one malformed instance can also abort enumeration across every service.
What should be done if upgrading is not immediately possible?
Remove the offending Consul service registration to restore discovery. Prevent principals that should not be able to disrupt discovery from registering or modifying Consul services.
Which versions are affected and which version fixes the issue?
Versions from 4.0.0 until 4.3.0 are affected. The issue is fixed in version 4.3.0.