Advisory Database
  • Advisories
  • Dependency Scanning
  1. nuget
  2. ›
  3. Steeltoe.Discovery.Consul
  4. ›
  5. CVE-2026-81516

CVE-2026-81516: Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)

September 17, 2026

Steeltoe’s Consul discovery client parses the secure metadata field on each registered service instance using bool.Parse, which throws on any value other than true or false. A single service instance registered with a malformed secure value (for example yes or 1) aborts construction of the entire instance list for that service, making the service undiscoverable. When GetAllInstancesAsync is used, one malformed instance in any service can abort enumeration across all services. This is the same “one malformed field aborts the whole batch” availability class as CVE-2026-50196, but affecting the Consul discovery client.

References

  • github.com/SteeltoeOSS/Steeltoe/commit/028569c4f4f0e9e393e3c22a4fa5d07987dd8673
  • github.com/SteeltoeOSS/Steeltoe/releases/tag/4.3.0
  • github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-67c9-f6v2-qv86
  • github.com/advisories/GHSA-67c9-f6v2-qv86
  • nvd.nist.gov/vuln/detail/CVE-2026-81516

Code Behaviors & Features

Detect and mitigate CVE-2026-81516 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 4.0.0 before 4.3.0

Fixed versions

  • 4.3.0

Solution

Upgrade to version 4.3.0 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-755: Improper Handling of Exceptional Conditions

Source file

nuget/Steeltoe.Discovery.Consul/CVE-2026-81516.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 22 Sep 2026 12:20:58 +0000.