Executive brief
A vulnerability in the Steeltoe Eureka client can cause a complete failure of service discovery within a cloud-native application environment. If any service in the network registers with a data center name that the client does not recognize (such as 'Netflix'), the client's local registry becomes corrupted and stops updating. This results in an application being unable to find or communicate with other services, leading to potential service outages and operational downtime.
Technical details
The Steeltoe Eureka client's DataCenterInfo.FromJson method incorrectly validates the 'name' field, throwing an ArgumentException for any value other than 'MyOwn' or 'Amazon'. This occurs even for valid specification values like 'Netflix'. Because this exception is swallowed by the periodic cache refresh task during deserialization, the local service registry fails to update and remains in a stale or empty state. An attacker or an incompatible legitimate service can trigger this denial-of-service condition by registering a service with an unsupported data center name. The issue is fixed in versions 3.4.0 and 4.2.0.
Affected products
- SteeltoeOSS Steeltoe.Discovery.Eureka >= 4.0.0, <= 4.1.0; <= 3.3.0
Timeline
- 2026-05-29: disclosed
- 2026-06-17: advisory: NVD published date
- 2026-07-02: patched: GitHub Advisory reviewed and updated
References
- https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-j8ph-6fxj-g533
- https://github.com/SteeltoeOSS/Steeltoe/commit/b8ed8557bb595863e4f340051d16b26ba40a75f4
- https://github.com/SteeltoeOSS/Steeltoe/commit/c34a7399e808d0d11dd977460e81df1f2722df28
- https://api.github.com/repos/SteeltoeOSS/security-advisories/security-advisories/GHSA-j8ph-6fxj-g533