Resource exhaustion in Steeltoeoss Steeltoe.discovery.eureka
CVE-2026-50196
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, `DataCenterInfo.FromJson` throws `ArgumentException` for any `name` value other than `"MyOwn"` or `"Amazon"`, despite the Java Eureka specification defining a third valid value: `"Netflix"`. The exception propagates through the entire registry deserialization chain and is swallowed by the periodic cache refresh task, leaving the local service registry permanently empty or stale. Versions 4.2.0 and 3.4.0 patch the issue. If an immediate upgrade is not possible, remove any registrations using unsupported `DataCenterInfo.name` values from the registry. In mixed Java/Spring and Steeltoe environments, audit for the `Netflix` data center type before deploying Steeltoe Eureka clients.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.003 (27.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Steeltoeoss Steeltoe.discovery.eureka — versions >= 4.0.0, < 4.2.0, < 3.4.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-50196?
- CVE-2026-50196 is a high-severity vulnerability in Steeltoeoss Steeltoe.discovery.eureka, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2026-06-17.
- How severe is CVE-2026-50196?
- High severity. CVSS v3 base score is 7.5 out of 10.