Steeltoe Eureka Discovery Client Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- steeltoe.discovery.eureka (nuget)
- Affected versions
- >= 4.1.0, <= 4.1.0 or >= 4.0.0, <= 4.0.0 or >= 3.3.0, <= 3.3.0 or >= 4.0.0-rc1, <= 4.0.0-rc1 or >= 3.2.8, <= 3.2.8 or >= 4.0.0-beta1, <= 4.0.0-beta1 or >= 3.2.7, <= 3.2.7 or >= 3.2.6, <= 3.2.6 or >= 3.2.5, <= 3.2.5 or >= 3.2.4, <= 3.2.4 or >= 3.2.3, <= 3.2.3 or >= 3.2.2, <= 3.2.2 or >= 3.2.1, <= 3.2.1 or >= 3.2.0, <= 3.2.0 or >= 3.2.0-rc1, <= 3.2.0-rc1 or >= 3.1.1, <= 3.1.1 or >= 3.1.0, <= 3.1.0 or >= 3.1.0-rc2, <= 3.1.0-rc2 or >= 3.1.0-rc1, <= 3.1.0-rc1 or >= 3.0.x_2021-Jan-12, <= 3.0.x_2021-Jan-12 or >= 3.0.2, <= 3.0.2 or >= 3.0.1, <= 3.0.1 or >= 3.0.0, <= 3.0.0 or >= 3.0.0-rc1, <= 3.0.0-rc1 or >= 3.0.0-m3, <= 3.0.0-m3 or >= 3.0.0-m2, <= 3.0.0-m2 or >= 3.0.0-m1, <= 3.0.0-m1
- Patched version
- Not yet available
An early warning has been issued for a vulnerability in Steeltoe's Eureka discovery client that can cause outages for all connected applications if a malformed field is present in the registry.
What happened
An early warning has been issued for a vulnerability in Steeltoe's Eureka discovery client. The client deserializes the registry response as a single unit. If any registered instance contains a field value that cannot be parsed, deserialization of the entire registry fails. This results in an outage for all Steeltoe applications connected to the same registry.
The vulnerability affects versions of steeltoe.discovery.eureka (nuget) from 3.0.0-m1 to 4.1.0, as well as various release candidates and beta versions. The issue has been tracked under CVE-2026-50196, GHSA-HR73-3GPV-HH6Q, and GHSA-J8PH-6FXJ-G533. It was first flagged on 2026-09-17T20:30:45+00:00.
What to do about it
- Audit the Eureka registry for registrations containing non-standard field values, particularly those originating from non-.NET clients.
- Restrict write access to the Eureka registration API to trusted services.
- Monitor the primary sources for updates on this vulnerability, as no official fix has been published yet.
How 0Day would have caught this
steeltoe.discovery.eureka is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using steeltoe.discovery.eureka (nuget) versions from 3.0.0-m1 to 4.1.0, as well as various release candidates and beta versions.
What should I do right now?
Audit the Eureka registry for non-standard field values and restrict write access to the Eureka registration API to trusted services. Monitor the primary sources for updates.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates.