Junglewise Threat Intelligence

CVE-2026-81516: Steeltoe.Discovery.Consul malformed secure metadata DoS

CVE-2026-81516 · Severity: high · CVSS 7.5 · Published 2026-09-17

Executive brief

Steeltoe's Consul discovery client crashes when it encounters a malformed 'secure' metadata field on any registered service instance, making that entire service undiscoverable. An attacker with access to register services in the Consul catalog can exploit this to cause a service discovery outage affecting all applications that depend on that service.

Technical details

The vulnerability is a parsing error in Steeltoe.Discovery.Consul's handling of the 'secure' metadata field. The client uses `bool.Parse()` which throws an exception on any value other than the literal strings 'true' or 'false' (e.g., 'yes', '1', 'on'). When parsing service instances, a single malformed 'secure' value aborts construction of the entire instance list for that service, and when `GetAllInstancesAsync` is called, one malformed instance across any service can stop enumeration for all services. Attack preconditions require the attacker to have write access to the Consul service registration API. The vulnerability affects any Steeltoe application using `ConsulDiscoveryClient`, particularly in mixed-platform environments where non-.NET clients may register services with non-standard metadata values. A patch is expected to add validation or fallback handling for non-boolean values.

Affected products

  • Steeltoe Steeltoe.Discovery.Consul <UNKNOWN>

Timeline

  • 2026-09-17: disclosed
  • advisory: CVE-2026-81516