CVE-2026-81515

High

Description

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, EurekaDiscoveryClient deserializes the registry response as one unit, and an unrecognized actionType or status, a non-Boolean isCoordinatingDiscoveryServer, or a nonnumeric timestamp can abort the entire response. A principal that can register or update an instance can cause all connected Steeltoe clients to receive an empty or stale instance list until the malformed registration is removed. The JsonInstanceInfoConverter, BoolStringJsonConverter, and LongStringJsonConverter parsing paths are affected. This issue is distinct from the earlier DataCenterInfo.name parsing vulnerability. This issue is fixed in version 4.3.0.

SeverityHigh

CVSS7.5

Exploit probability—

ProductSteeltoe.discovery.eureka

PublishedSep 17, 2026

First seenSep 17, 2026

Weakness typeCWE-755CWE-755

How to fix

Update

Steeltoe.Discovery.Eureka4.3.0 or later

Affected products

Product	Affected versions	Fixed in
Steeltoe.Discovery.EurekaNuGet	4.0.0 ≤ v < 4.3.0	4.3.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.