CVE-2026-81515: Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)
Steeltoe’s Eureka discovery client deserializes the registry response as a single unit. If any registered instance contains a field value that cannot be parsed (for example, an unrecognized actionType, a non-boolean value for isCoordinatingDiscoveryServer, or a non-numeric timestamp), deserialization of the entire registry fails. All Steeltoe Eureka clients connected to that registry then receive an empty or stale instance list until the malformed registration is removed.
This is a related but distinct issue from CVE-2026-50196, which addressed only the DataCenterInfo.name field.
References
- github.com/SteeltoeOSS/Steeltoe/commit/bc1c3763aacc1fee82ef9932f338ec08dcb00432
- github.com/SteeltoeOSS/Steeltoe/releases/tag/4.3.0
- github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-hr73-3gpv-hh6q
- github.com/advisories/GHSA-hr73-3gpv-hh6q
- github.com/advisories/GHSA-j8ph-6fxj-g533
- nvd.nist.gov/vuln/detail/CVE-2026-81515
Code Behaviors & Features
Detect and mitigate CVE-2026-81515 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →