CVE-2026-81515: 
C# vulnerability analysis and mitigation

CVE-2026-81515 is a Denial of Service vulnerability in the Steeltoe.Discovery.Eureka NuGet package, a component of the open-source Steeltoe framework for building cloud-native .NET applications. The flaw causes EurekaDiscoveryClient to abort deserialization of the entire Eureka registry response when any single registered instance contains a malformed field value, leaving all connected Steeltoe clients with an empty or stale service instance list. Affected versions are >= 4.0.0 and <= 4.2.0; the issue is fixed in version 4.3.0. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory). The advisory was originally published on September 9, 2026, and subsequently published to the NVD on September 17, 2026 (Github Advisory).

The root cause is improper handling of exceptional conditions (CWE-755) in three JSON converter classes: JsonInstanceInfoConverter, BoolStringJsonConverter, and LongStringJsonConverter. Because EurekaDiscoveryClient deserializes the entire registry response as a single unit, a parsing exception thrown by any one of these converters — triggered by an unrecognized actionType enum value, a non-boolean string for isCoordinatingDiscoveryServer (e.g., "maybe"), or a non-numeric timestamp string (e.g., "not-a-number") — aborts processing of the complete response (Github Advisory). The fix in version 4.3.0 (commit bc1c376) changes JsonInstanceInfoConverter to deserialize instances individually using a try/catch block, silently skipping malformed entries rather than failing the entire fetch, and updates BoolStringJsonConverter and LongStringJsonConverter to use TryParse instead of throwing on invalid input (Steeltoe Commit). This issue is distinct from the related predecessor vulnerability CVE-2026-50196, which only addressed the DataCenterInfo.name field (Github Advisory). Mixed-platform environments where Java or Spring services share the same Eureka registry are at elevated risk, as non-.NET clients may legitimately produce field values that Steeltoe's strict parsers cannot handle.

Successful exploitation results in a complete service-discovery outage for all Steeltoe applications connected to the affected Eureka registry. Clients receive an empty or stale instance list, preventing them from routing requests to backend services, which can cascade into application-level failures across the entire microservice mesh. There is no confidentiality or integrity impact; the sole consequence is high availability impact. The outage persists until the malformed service registration is identified and removed from the registry (Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is 0.0, indicating a very low current probability of exploitation (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. While no authentication is required to trigger the DoS once a malformed registration is in the registry, an attacker must first have the ability to register or update a service instance in the Eureka registry, which typically requires network access to the registration API.

1. Identify target registry: Locate a Steeltoe application (versions 4.0.0–4.2.0) using EurekaDiscoveryClient and identify the Eureka server endpoint it polls for service discovery.
2. Gain registry write access: Obtain the ability to register or update a service instance in the Eureka registry. In many deployments, the registration API may be accessible to any service on the internal network without strong authentication.
3. Craft a malformed registration payload: Construct a service instance registration JSON payload containing one of the following malformed fields:
   • An unrecognized actionType value (e.g., "actionType": "SOMETHING_ELSE" instead of "ADDED" or "MODIFIED").
   • A non-boolean string for isCoordinatingDiscoveryServer (e.g., "isCoordinatingDiscoveryServer": "maybe").
   • A non-numeric string for a timestamp field (e.g., "lastDirtyTimestamp": "not-a-number").
4. Register the malformed instance: Submit the crafted payload to the Eureka registration endpoint (e.g., POST /eureka/apps/{appName}).
5. Trigger DoS: When any connected Steeltoe client next polls the registry (typically on a short interval), the JsonInstanceInfoConverter will throw a JsonException while deserializing the malformed instance, aborting the entire response and leaving the client with an empty or stale instance list.
6. Sustain the outage: The denial of service persists as long as the malformed registration remains in the registry, since every subsequent poll will fail in the same way (Github Advisory).

• Logs: Repeated JsonException or FormatException stack traces in Steeltoe application logs originating from JsonInstanceInfoConverter, BoolStringJsonConverter, or LongStringJsonConverter during Eureka registry fetch operations.
• Logs: Steeltoe client logs reporting empty or unexpectedly stale service instance lists after a registry poll, particularly if the registry is known to contain active services.
• Network: Unexpected POST or PUT requests to the Eureka registration API (/eureka/apps/{appName}) from unfamiliar or non-.NET service identities.
• Registry Inspection: Presence of service instance registrations in the Eureka registry containing non-standard field values such as unrecognized actionType strings, non-boolean isCoordinatingDiscoveryServer values, or non-numeric timestamp fields, especially from sources not expected to be in the registry.

Upgrade Steeltoe.Discovery.Eureka to version 4.3.0 or later, which resolves the issue by deserializing instances individually and gracefully skipping malformed entries (Steeltoe Release). If an immediate upgrade is not possible, apply the following interim mitigations: audit the Eureka registry for registrations with non-standard field values (particularly from non-.NET clients), and restrict write access to the Eureka registration API to trusted services only (Github Advisory). Monitor Steeltoe client logs for deserialization errors as an early indicator of a potential attack or accidental misconfiguration.