Steeltoe Eureka EUVD-2026-81901

Requires that the attacker be a principal able to register or update an instance in the Eureka service registry that Steeltoe clients consume, and that victim applications use Steeltoe EurekaDiscoveryClient versions 4.0.0 through 4.2.x. The specific trigger is a single instance record whose actionType or status is unrecognized, whose isCoordinatingDiscoveryServer is non-Boolean, or whose timestamp is nonnumeric - parsed by JsonInstanceInfoConverter, BoolStringJsonConverter, or LongStringJsonConverter. Limiting factors: impact is confined to service-discovery availability (no data exposure or code execution), the malformed effect is transient (self-heals once the bad registration is removed), and practical exploitation depends on the Eureka deployment allowing the attacker to write a registration - many deployments keep Eureka registration inside a trusted network, which reduces real-world exposure despite the PR:N vendor rating.

This is a genuine but bounded availability-only issue. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) rates it network-exploitable, low-complexity, and unauthenticated with high availability impact and no confidentiality or integrity effect. There is no EPSS score, no CISA KEV listing, and no public exploit provided - so exploitation status is 'no public exploit identified at time of analysis.' The most important nuance is a signal conflict: the vector claims PR:N (unauthenticated), but the description explicitly requires 'a principal that can register or update an instance,' which is a privilege on the Eureka registry - verify with vendor, as I assess PR:L is more accurate. CWE-755 (improper handling of exceptional conditions) fits precisely: one malformed field aborts deserialization of the whole registry response. The 7.5 score is honest for the impact class but should not be read as a mass-exploitable internet-facing bug - it requires access to a Eureka registration path and only degrades service discovery, not data. Priority is moderate for organizations running Steeltoe-based .NET microservices behind a shared Eureka server; low for everyone else.

An attacker who can register or update a service instance in the shared Eureka registry (a rogue or compromised microservice, or anyone with reachable registration endpoints) submits a registration containing an unrecognized actionType/status, a non-Boolean isCoordinatingDiscoveryServer, or a nonnumeric timestamp. Because Steeltoe deserializes the entire registry response as one unit, this single malformed record throws a JsonException that aborts parsing of the whole response, so every connected Steeltoe client receives an empty or stale instance list until the bad registration is removed. No public proof-of-concept is provided, though the fix commit ships a test payload (actionType 'SOMETHING_ELSE') that demonstrates the trigger.