CVE-2026-50196: Steeltoe Discovery Eureka DoS Vulnerability

CVE-2026-50196 Overview

CVE-2026-50196 is an input validation flaw [CWE-20] in Steeltoe.Discovery.Eureka, an open source library for building cloud-native .NET applications. The vulnerability exists in DataCenterInfo.FromJson, which throws an ArgumentException for any name value other than "MyOwn" or "Amazon". The Java Eureka specification defines "Netflix" as a third valid value, which Steeltoe rejects. The exception propagates through the registry deserialization chain and is swallowed by the periodic cache refresh task. This leaves the local service registry permanently empty or stale, breaking service discovery for affected applications.

Critical Impact
A single registration with a Netflix data center name poisons the Eureka cache refresh in Steeltoe clients, causing complete service registry unavailability and discovery failure across the .NET application.

Affected Products

Steeltoe.Discovery.Eureka versions prior to 4.2.0 (4.x branch)
Steeltoe.Discovery.Eureka versions prior to 3.4.0 (3.x branch)
.NET cloud-native applications using Steeltoe Eureka clients in mixed Java/Spring environments

Discovery Timeline

2026-06-17 - CVE-2026-50196 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-50196

Vulnerability Analysis

The vulnerability resides in the JSON deserialization path of DataCenterInfo within Steeltoe.Discovery.Eureka. When the Eureka client retrieves the service registry, each registration includes a DataCenterInfo object with a name field. Steeltoe's parser accepts only MyOwn and Amazon, rejecting the Netflix value defined by the upstream Java Eureka specification.

When FromJson encounters an unsupported name, it throws ArgumentException (later ArgumentOutOfRangeException). The exception propagates upward through the application deserialization chain. The periodic cache refresh task catches and silently swallows the exception, terminating the entire refresh cycle without populating any service instances.

The result is a persistent denial of service against the local registry. Downstream service-to-service calls fail because no instances are resolvable. The condition persists until the offending registration is removed from the Eureka server.

Root Cause

The root cause is incomplete input validation in DataCenterInfo.FromJson. The parser enumerates only two of the three valid Eureka data center names. Combined with an exception-on-unknown-value strategy rather than graceful degradation, a single malformed or non-.NET registration breaks all discovery for Steeltoe clients sharing that registry.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. Any actor able to register a service with the Eureka server using a Netflix data center type triggers the condition. In mixed Java/Spring and Steeltoe environments, this can occur during normal Java client operation without malicious intent.

text

// Patch in src/Discovery/src/Eureka/AppInfo/DataCenterInfo.cs
         {
             return new DataCenterInfo(DataCenterName.Amazon);
         }
+        else if (DataCenterName.Netflix.ToString().Equals(jcenter.Name))
+        {
+            return new DataCenterInfo(DataCenterName.Netflix);
+        }
         else
         {
-            throw new ArgumentOutOfRangeException("Datacenter name");
+            return null;
         }
     }

Source: Steeltoe commit b8ed855

text

// Patch in src/Discovery/src/Eureka/Configuration/DataCenterInfo.cs
             };
         }
 
-        throw new ArgumentException($"Unsupported datacenter name '{jsonDataCenterInfo.Name}'.", nameof(jsonDataCenterInfo));
+        if (jsonDataCenterInfo.Name == nameof(DataCenterName.Netflix))
+        {
+            return new DataCenterInfo
+            {
+                Name = DataCenterName.Netflix
+            };
+        }
+
+        return null;
     }

Source: Steeltoe commit c34a739

The patches add explicit handling for the Netflix value and replace the exception with a null return, allowing the deserialization chain to continue.

Detection Methods for CVE-2026-50196

Indicators of Compromise

Steeltoe application logs containing ArgumentException or ArgumentOutOfRangeException from DataCenterInfo.FromJson
Empty or stale Eureka client registry caches despite a healthy Eureka server
Service discovery resolution failures coinciding with periodic cache refresh intervals
Eureka registry entries with dataCenterInfo.name equal to Netflix in mixed Java/.NET environments

Detection Strategies

Query the Eureka server REST API at /eureka/apps and grep for "name":"Netflix" within dataCenterInfo blocks
Enable verbose logging in Steeltoe.Discovery.Eureka and alert on repeated registry refresh exceptions
Inventory all Steeltoe.Discovery.Eureka package versions in the build pipeline using dependency scanning

Monitoring Recommendations

Track Eureka client cache size metrics and alert when the local registry drops to zero unexpectedly
Correlate service discovery failures with Eureka refresh task error events
Monitor new service registrations for non-standard DataCenterInfo values before they propagate to Steeltoe clients

How to Mitigate CVE-2026-50196

Immediate Actions Required

Upgrade Steeltoe.Discovery.Eureka to version 4.2.0 (4.x) or 3.4.0 (3.x)
Audit the Eureka registry for any service registrations using Netflix as the DataCenterInfo.name
Remove or re-register affected instances with MyOwn or Amazon until clients are patched
Coordinate with Java/Spring teams before introducing Steeltoe clients into shared discovery infrastructure

Patch Information

The fix is delivered in Steeltoe.Discovery.Eureka 4.2.0 and 3.4.0. The patches add explicit handling for the Netflix data center name and change the failure mode from exception throwing to returning null, allowing the deserialization chain to continue gracefully. See GHSA-j8ph-6fxj-g533 for advisory details.

Workarounds

Remove any Eureka registrations with unsupported DataCenterInfo.name values from the registry
Audit mixed Java/Spring and Steeltoe environments for Netflix data center types before deploying Steeltoe Eureka clients
Restrict Eureka server registration to internal services that conform to supported DataCenterInfo values

bash

# Identify offending registrations on the Eureka server
curl -s -H "Accept: application/json" http://eureka-server:8761/eureka/apps \
  | jq '.applications.application[].instance[] | select(.dataCenterInfo.name=="Netflix") | {app:.app, instanceId:.instanceId}'

# Upgrade Steeltoe package in the .NET project
dotnet add package Steeltoe.Discovery.Eureka --version 4.2.0