CVE-2026-50196 Details
Description
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, `DataCenterInfo.FromJson` throws `ArgumentException` for any `name` value other than `"MyOwn"` or `"Amazon"`, despite the Java Eureka specification defining a third valid value: `"Netflix"`. The exception propagates through the entire registry deserialization chain and is swallowed by the periodic cache refresh task, leaving the local service registry permanently empty or stale. Versions 4.2.0 and 3.4.0 patch the issue. If an immediate upgrade is not possible, remove any registrations using unsupported `DataCenterInfo.name` values from the registry. In mixed Java/Spring and Steeltoe environments, audit for the `Netflix` data center type before deploying Steeltoe Eureka clients.
A vulnerability exists in Steeltoe.Discovery.Eureka versions 4.0.0 prior to 4.2.0 and 3.3.0 prior to 3.4.0, where the 'DataCenterInfo.FromJson' method throws an 'ArgumentException' for any 'name' value other than 'MyOwn' or 'Amazon'. This behavior contradicts the Java Eureka specification, which recognizes 'Netflix' as a valid value. The resulting exception disrupts the registry deserialization process and is ignored by the periodic cache refresh task, causing the local service registry to become permanently empty or outdated. In environments that mix Java/Spring and Steeltoe, this issue can be inadvertently triggered by a Java or Spring service that registers with the 'Netflix' data center type.
Upgrade to Steeltoe.Discovery.Eureka versions 4.2.0 or 3.4.0. If an immediate upgrade is not possible, remove any registrations with unsupported 'DataCenterInfo.name' values from the registry. In mixed Java/Spring and Steeltoe environments, audit for the 'Netflix' data center type before deploying Steeltoe Eureka clients.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 17, 2026CISA-ADP
Assessed Jun 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Steeltoe.Discovery.Eureka | >= 4.0.0, <= 4.1.0 (semver) <= 3.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 18, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |