Improper Handling of Exceptional Conditions Affecting steeltoe.discovery.eureka package, versions [4.0.0,4.3.0)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DOTNET-STEELTOEDISCOVERYEUREKA-20079557
- published24 Sept 2026
- disclosed17 Sept 2026
- creditmanus-use
Introduced: 17 Sep 2026
NewCVE-2026-81515 (opens in a new tab)How to fix?
Upgrade Steeltoe.Discovery.Eureka to version 4.3.0 or higher.
Overview
Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions through the JsonInstanceInfoConverter in src/Discovery/src/Eureka/Transport/JsonInstanceInfoConverter.cs. An attacker can prevent Eureka registry fetches from succeeding by registering or updating a service instance with a malformed enum, boolean, or timestamp field in the registry response. When EurekaDiscoveryClient deserializes the applications payload, a single bad instance value aborts parsing of the entire registry, leaving Steeltoe clients with an empty or stale service list until the offending registration is removed.
Workarounds
- Audit the Eureka registry for registrations containing non-standard field values, especially instances coming from non-.NET clients; remove or correct malformed
actionType,status,isCoordinatingDiscoveryServer, and timestamp values so a bad instance cannot break registry deserialization for Steeltoe clients. - Restrict write access to the Eureka registration API to trusted services only, so untrusted principals cannot register or update an instance with malformed values that would trigger the registry-fetch denial of service.