CVE-2026-81516: Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)
Steeltoe’s Consul discovery client parses the secure metadata field on each registered service instance using bool.Parse, which throws on any value other than true or false. A single service instance registered with a malformed secure value (for example yes or 1) aborts construction of the entire instance list for that service, making the service undiscoverable. When GetAllInstancesAsync is used, one malformed instance in any service can abort enumeration across all services.
This is the same “one malformed field aborts the whole batch” availability class as CVE-2026-50196, but affecting the Consul discovery client.
References
Code Behaviors & Features
Detect and mitigate CVE-2026-81516 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →