CVE-2026-81516: 
C# vulnerability analysis and mitigation

CVE-2026-81516 is a Denial of Service (DoS) vulnerability in Steeltoe's Steeltoe.Discovery.Consul NuGet package, titled "malformed 'secure' metadata aborts service instance lookup." It affects Steeltoe versions 4.0.0 through 4.2.0 (inclusive) and was published on September 9, 2026, with NVD publication on September 17, 2026. A principal with Consul service registration permissions can register a service with a malformed secure metadata value, causing the discovery client to throw an unhandled exception that aborts enumeration of all service instances. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, GHSA Advisory).

The root cause is improper handling of exceptional conditions (CWE-755): ConsulServiceInstance uses bool.Parse(secureString) to parse the secure metadata field from Consul service registrations, which throws a FormatException on any value other than "true" or "false" (e.g., "yes", "1"). This unhandled exception propagates up and aborts construction of the entire ConsulServiceInstance list for the affected service. When GetAllInstancesAsync is invoked to enumerate all services, a single malformed registration in any service can abort the entire enumeration, making all services undiscoverable. The fix, applied in commit 028569c, replaces bool.Parse with bool.TryParse, which returns false on invalid input instead of throwing (GHSA Advisory, Fix Commit).

Successful exploitation results in a complete service-discovery outage for all Steeltoe applications using ConsulDiscoveryClient. The outage affects all instances of the targeted service — not just the malformed registration — and persists until the offending Consul registration is manually removed. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue. Mixed-platform environments where non-.NET clients register services with non-standard metadata values are particularly susceptible to accidental triggering of this condition (Github Advisory, GHSA Advisory).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack is automatable and requires no authentication or user interaction — only the ability to register a service in the Consul catalog — making it low-complexity for any principal with that access (Github Advisory, Feedly).

1. Identify target: Confirm the target environment uses Steeltoe 4.0.0–4.2.0 with ConsulDiscoveryClient and has a reachable Consul service registration API.
2. Obtain registration access: Acquire credentials or a token with write access to the Consul service catalog (e.g., via a misconfigured ACL policy, compromised service token, or an environment with open Consul access).
3. Register malformed service: Use the Consul HTTP API or CLI to register a service instance with a secure metadata value that is not "true" or "false", for example:

   PUT /v1/agent/service/register
   { "Name": "target-service", "Meta": { "secure": "yes" } }

4. Trigger enumeration failure: When any Steeltoe application calls GetAllInstancesAsync or attempts to resolve the targeted service, bool.Parse("yes") throws a FormatException, aborting the entire instance list construction.
5. Sustain outage: The denial of service persists until the malformed registration is manually identified and removed from the Consul catalog, as the exception is thrown on every subsequent discovery attempt (GHSA Advisory, Fix Commit).

• Logs: Repeated FormatException or System.FormatException: String 'yes' was not recognized as a valid Boolean stack traces in application logs originating from ConsulServiceInstance constructor or ConsulDiscoveryClient.
• Logs: Application log entries showing service discovery failures or empty instance lists returned for one or more services, particularly if sudden and persistent.
• Network: Unexpected or unauthorized calls to the Consul service registration API (PUT /v1/agent/service/register or PUT /v1/catalog/register) from unfamiliar sources.
• Consul Catalog: Presence of service registrations with secure metadata values other than "true" or "false" (e.g., "yes", "1", "on") — auditable via GET /v1/catalog/services and inspecting each service's metadata (GHSA Advisory).

Upgrade Steeltoe.Discovery.Consul to version 4.3.0 or later, which replaces bool.Parse with bool.TryParse to handle malformed metadata gracefully without throwing (Steeltoe 4.3.0 Release, Fix Commit). If an immediate upgrade is not possible, audit the Consul catalog for service registrations with non-standard secure metadata values and remove any offending entries. Additionally, restrict write access to the Consul service registration API to only trusted and authenticated services to reduce the attack surface (GHSA Advisory).