CVE-2026-50196: CWE-20: Improper Input Validation in SteeltoeOSS Steeltoe.Discovery.Eureka
Steeltoe.Discovery.Eureka versions prior to 3.4.0 and 4.2.0 improperly handle the DataCenterInfo.FromJson method by throwing an exception for the valid 'Netflix' data center name, which is defined in the Java Eureka specification. This causes the local service registry to become permanently empty or stale due to swallowed exceptions during cache refresh. The issue is patched in versions 3.4.0 and 4.2.0. If upgrading immediately is not possible, removing unsupported DataCenterInfo.name values from the registry is recommended.
AI Analysis
Technical Summary
The vulnerability in Steeltoe.Discovery.Eureka prior to versions 3.4.0 and 4.2.0 involves improper input validation in the DataCenterInfo.FromJson method. The method throws an ArgumentException when encountering a 'name' value other than 'MyOwn' or 'Amazon', despite 'Netflix' being a valid value per the Java Eureka specification. This exception propagates through the registry deserialization process and is swallowed by the periodic cache refresh task, resulting in the local service registry remaining empty or stale indefinitely. This behavior can disrupt service discovery in mixed Java/Spring and Steeltoe environments. The issue is resolved in versions 3.4.0 and 4.2.0.
Potential Impact
The improper input validation causes the local service registry to become permanently empty or stale, which can disrupt service discovery functionality. This results in a denial of availability for the service registry component, impacting applications relying on Steeltoe.Discovery.Eureka for cloud-native service discovery. There is no direct confidentiality or integrity impact reported.
Mitigation Recommendations
A fix is available in Steeltoe.Discovery.Eureka versions 3.4.0 and 4.2.0. Users should upgrade to these versions to resolve the issue. If immediate upgrading is not feasible, remove any registry entries using unsupported DataCenterInfo.name values such as 'Netflix' from the registry. Additionally, audit mixed Java/Spring and Steeltoe environments for the 'Netflix' data center type before deploying Steeltoe Eureka clients to prevent the issue.
CVE-2026-50196: CWE-20: Improper Input Validation in SteeltoeOSS Steeltoe.Discovery.Eureka
Description
Steeltoe.Discovery.Eureka versions prior to 3.4.0 and 4.2.0 improperly handle the DataCenterInfo.FromJson method by throwing an exception for the valid 'Netflix' data center name, which is defined in the Java Eureka specification. This causes the local service registry to become permanently empty or stale due to swallowed exceptions during cache refresh. The issue is patched in versions 3.4.0 and 4.2.0. If upgrading immediately is not possible, removing unsupported DataCenterInfo.name values from the registry is recommended.
CVSS v3.1
Score 7.5high
Affected software
pkg:nuget/steeltoe.discovery.eurekaRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Steeltoe.Discovery.Eureka prior to versions 3.4.0 and 4.2.0 involves improper input validation in the DataCenterInfo.FromJson method. The method throws an ArgumentException when encountering a 'name' value other than 'MyOwn' or 'Amazon', despite 'Netflix' being a valid value per the Java Eureka specification. This exception propagates through the registry deserialization process and is swallowed by the periodic cache refresh task, resulting in the local service registry remaining empty or stale indefinitely. This behavior can disrupt service discovery in mixed Java/Spring and Steeltoe environments. The issue is resolved in versions 3.4.0 and 4.2.0.
Potential Impact
The improper input validation causes the local service registry to become permanently empty or stale, which can disrupt service discovery functionality. This results in a denial of availability for the service registry component, impacting applications relying on Steeltoe.Discovery.Eureka for cloud-native service discovery. There is no direct confidentiality or integrity impact reported.
Mitigation Recommendations
A fix is available in Steeltoe.Discovery.Eureka versions 3.4.0 and 4.2.0. Users should upgrade to these versions to resolve the issue. If immediate upgrading is not feasible, remove any registry entries using unsupported DataCenterInfo.name values such as 'Netflix' from the registry. Additionally, audit mixed Java/Spring and Steeltoe environments for the 'Netflix' data center type before deploying Steeltoe Eureka clients to prevent the issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-03T22:05:13.645Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a33168ef198dc38c1148dc9
Added to database: 06/17/2026, 21:50:06 UTC
Last enriched: 07/02/2026, 23:07:38 UTC
Last updated: 07/14/2026, 19:47:33 UTC
Views: 54
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.