CVE-2026-81515

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81515
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81515.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81515
Aliases
Published
2026-09-17T15:40:11Z
Modified
2026-09-18T03:48:30Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)
Details

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, EurekaDiscoveryClient deserializes the registry response as one unit, and an unrecognized actionType or status, a non-Boolean isCoordinatingDiscoveryServer, or a nonnumeric timestamp can abort the entire response. A principal that can register or update an instance can cause all connected Steeltoe clients to receive an empty or stale instance list until the malformed registration is removed. The JsonInstanceInfoConverter, BoolStringJsonConverter, and LongStringJsonConverter parsing paths are affected. This issue is distinct from the earlier DataCenterInfo.name parsing vulnerability. This issue is fixed in version 4.3.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-755"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81515.json"
}
References

Affected packages

Git / github.com/steeltoeoss/steeltoe

Affected ranges

Type
GIT
Repo
https://github.com/steeltoeoss/steeltoe
Events
Introduced
c4d303abd0d8a53b62516c0281643e00c1a69f0e
Fixed
a56a5e5a324a1581cbfcdf726dbca3e25b604f86
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.3.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81515.json"