What is the CVSS score of CVE-2026-50196?

CVE-2026-50196 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Steeltoe Discovery Eureka are affected by CVE-2026-50196?

Steeltoe.Discovery.Eureka client versions before 4.2.0 and 3.4.0 suffer from a denial-of-service vulnerability that permanently disables service discovery, preventing .NET microservices from locating…. A patch is available.

How to fix or mitigate CVE-2026-50196?

Within 24 hours: Identify all systems running Steeltoe.Discovery.Eureka prior to 4.2.0 (for 4.x) or 3.4.0 (for 3.x) and categorize by production criticality. Within 7 days: Deploy patches to non-critical systems and begin pilot testing on critical infrastructure. Within 30 days: Complete migration to patched versions (4.2.0 or 3.4.0) across all production systems.

Steeltoe Discovery Eureka CVE-2026-50196

EUVD-2026-37806 HIGH

Improper Input Validation (CWE-20)

2026-06-17 GitHub_M

GHSA-j8ph-6fxj-g533

Deserialization Java Steeltoe Discovery Eureka

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Trigger arrives over the network via Eureka registration (AV:N, AC:L) but requires the ability to register a service with the shared registry, so PR:L; impact is loss of discovery availability only (A:H, C/I:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 02, 2026 - 22:02 EUVD

Source Code Evidence Fetched

Jun 17, 2026 - 22:16 vuln.today

Analysis Generated

Jun 17, 2026 - 22:16 vuln.today

DescriptionCVE.org

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, DataCenterInfo.FromJson throws ArgumentException for any name value other than "MyOwn" or "Amazon", despite the Java Eureka specification defining a third valid value: "Netflix". The exception propagates through the entire registry deserialization chain and is swallowed by the periodic cache refresh task, leaving the local service registry permanently empty or stale. Versions 4.2.0 and 3.4.0 patch the issue. If an immediate upgrade is not possible, remove any registrations using unsupported DataCenterInfo.name values from the registry. In mixed Java/Spring and Steeltoe environments, audit for the Netflix data center type before deploying Steeltoe Eureka clients.

Articles & Coverage 1

News 5 New Java Vulnerabilities - 2 Critical, 3 High Severity Jun 18, 2026

AnalysisAI

Denial of service in Steeltoe.Discovery.Eureka client (.NET) versions prior to 4.2.0 and 3.4.0 allows a remote Eureka registry containing service registrations with DataCenterInfo.name="Netflix" to permanently break the local service discovery cache. The client's DataCenterInfo.FromJson rejects any value other than "MyOwn" or "Amazon" with an ArgumentException that is silently swallowed by the periodic cache refresh task, leaving downstream .NET services unable to discover peers. No public exploit identified at time of analysis, but the trigger is trivially reachable in mixed Java/Spring-Cloud and Steeltoe environments.

Technical ContextAI

Steeltoe is the .NET port of Spring Cloud and provides Eureka service discovery client libraries that interoperate with Netflix/Java Eureka servers. The Java Eureka specification defines three valid DataCenterInfo.name enum values - MyOwn, Amazon, and Netflix - but the Steeltoe C

implementation in src/Discovery/src/Eureka/AppInfo/DataCenterInfo.cs only handled the first two and threw ArgumentOutOfRangeException on the third. This is a CWE-20 (Improper Input Validation) defect: an unexpected-but-spec-valid enum literal causes an exception that propagates through JsonInstanceInfo deserialization, is caught by the outer periodic refresh task, and aborts the entire registry refresh rather than skipping the single bad entry. The fix (commits b8ed855 and c34a739) accepts the Netflix value and changes the unknown-name path to return null instead of throwing, restoring per-entry resilience.

RemediationAI

Vendor-released patch: upgrade Steeltoe.Discovery.Eureka to 4.2.0 (4.x line) or 3.4.0 (3.x line), per advisory GHSA-j8ph-6fxj-g533 (https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-j8ph-6fxj-g533) and fix commits b8ed8557bb595863e4f340051d16b26ba40a75f4 and c34a7399e808d0d11dd977460e81df1f2722df28. If immediate upgrade is not possible, audit the Eureka registry and de-register any service instances whose DataCenterInfo.name is anything other than "MyOwn" or "Amazon" (particularly "Netflix" emitted by Java/Spring-Cloud clients), and gate new Java/Spring registrations with a policy that rewrites or rejects name="Netflix"; the trade-off is reduced fidelity for Java consumers that legitimately use that data center type. As a stop-gap, restarting affected Steeltoe clients only restores discovery temporarily because the next refresh will re-fetch the poisoned entry, so the registry-side cleanup must happen before the restart.