TI-2026-36955 Aliases CVE-2026-50196 GHSA-j8ph-6fxj-g533

Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

LOW 39CWE-20Published 2026-06-17 · Updated 2026-06-18

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, `DataCenterInfo.FromJson` throws `ArgumentException` for any `name` value other than `"MyOwn"` or `"Amazon"`, despite the Java Eureka specification defining a third valid value: `"Netflix"`. The exception propagates through the entire registry deserialization chain and is swallowed by the periodic cache refresh task, leaving the local service registry permanently empty or stale. Versions 4.2.0 and 3.4.0 patch the issue. If an immediate upgrade is not possible, remove any registrations using unsupported `DataCenterInfo.name` values from the registry. In mixed Java/Spring and Steeltoe environments, audit for the `Netflix` data center type before deploying Steeltoe Eureka clients.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00446 39th percentileScored 2026-11-07

Fix Fixed Steeltoe.Discovery.Eureka (SteeltoeOSS): 4.2.0, 3.4.0Steeltoe.Discovery.Eureka (NuGet): 4.2.0, 3.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SteeltoeOSS	Steeltoe.Discovery.Eureka	4.0.0 to before 4.2.0; before 3.4.0	4.2.0, 3.4.0	Patch available	CNA
—	Steeltoe.Discovery.Eureka (NuGet)	4.0.0 to before 4.2.0	4.2.0	Patch available	GHSA-j8ph-6fxj-g533
—	Steeltoe.Discovery.Eureka (NuGet)	before 3.4.0	3.4.0	Patch available	GHSA-j8ph-6fxj-g533

Steeltoe.Discovery.Eureka VendorSteeltoeOSS Affected 4.0.0 to before 4.2.0; before 3.4.0 Fixed in 4.2.0, 3.4.0 Patch available CNA
Steeltoe.Discovery.Eureka (NuGet) Vendor— Affected 4.0.0 to before 4.2.0 Fixed in 4.2.0 Patch available GHSA-j8ph-6fxj-g533
Steeltoe.Discovery.Eureka (NuGet) Vendor— Affected before 3.4.0 Fixed in 3.4.0 Patch available GHSA-j8ph-6fxj-g533

Remediation

Fix · CNA Steeltoe.Discovery.Eureka (SteeltoeOSS) Fixed in 4.2.0, 3.4.0
Fix · GHSA-j8ph-6fxj-g533 Steeltoe.Discovery.Eureka (NuGet) Fixed in 4.2.0 Advisory →
Fix · GHSA-j8ph-6fxj-g533 Steeltoe.Discovery.Eureka (NuGet) Fixed in 3.4.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-50196
2026-10-03 Alias added: GHSA-j8ph-6fxj-g533
2026-10-25 Priority changed: MEDIUM → LOW

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-50196

Other 4

TI-2024-27048 Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness CVSS 3.1MEDIUM 5.3
TI-2026-36953 Steeltoe vulnerable to management-port isolation bypass via spoofed Host header CVSS 3.1HIGH 8.2
TI-2026-56238 Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS) CVSS 3.1HIGH 7.5
TI-2026-56237 Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS) CVSS 3.1HIGH 7.5
TI-2026-36959 Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords CVSS 3.1HIGH 7.5
TI-2026-56482 Steeltoe: Header-forwarded client cert lacks proof of private-key possession CVSS 3.1MEDIUM 6.5

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences