{"items":[{"id":"NVI-00013868","kind":"vulnerability","title":"Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-hr73-3gpv-hh6q","CVE-2026-81515"],"plain_summary":"GitHub lists this reviewed advisory for Steeltoe.Discovery.Eureka. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2104bbb589c7144ef474b95a25a0cc83"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-17T20:30:48.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-129647c15a43e76f556df5dd70e5da3e"},{"kind":"EPSS","as_of":"2026-11-03T12:00:27.000Z","value":"0.609%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.49218. Missing scores are unknown.","source_id":"sr-2104bbb589c7144ef474b95a25a0cc83"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-129647c15a43e76f556df5dd70e5da3e","url":"https://github.com/advisories/GHSA-hr73-3gpv-hh6q","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-hr73-3gpv-hh6q","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T14:29:49.409Z"},{"id":"sr-2104bbb589c7144ef474b95a25a0cc83","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-81515","publisher":"FIRST EPSS","observed_at":"2026-11-03T17:45:16.082Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-129647c15a43e76f556df5dd70e5da3e"],"technology":"Steeltoe.Discovery.Eureka","known_exclusions":[],"conditions_summary":"## Summary\n\nSteeltoe's Eureka discovery client deserializes the registry response as a single unit. If any registered instance contains a field value that cannot be parsed (for example, an unrecognized `actionType`, a non-boolean value for `isCoordinatingDiscoveryServer`, or a non-numeric timestamp), deserialization of the entire registry fails. All Steeltoe Eureka clients connected to that registry then receive an empty or stale instance list until the malformed registration is removed.\n\nThis is a related but distinct issue from CVE-2026-50196, which addressed only the `DataCenterInfo.name` field.\n\n## Impact\n\nAny principal that can register or update a service instance in the Eureka registry can trigger a service-discovery outage for all Steeltoe applications connected to the same registry. The outage persists until the offending registration is removed.\n\n## Affected configuration\n\n* Application uses `EurekaDiscoveryClient` (any deployment, including self-hosted Eureka).\n* The registry contains at least one service instance with an unrecognized value in a field such as `actionType`, `status`, `isCoordinatingDiscoveryServer`, or ","public_affected_ranges":[">= 4.0.0, <= 4.2.0"]}],"null_published_at":"2026-11-07T14:01:55.428Z","source_updated_at":"2026-09-17T20:30:48.000Z","source_disclosed_at":"2026-09-17T20:30:45.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T14:29:49.409Z"},{"id":"NVI-00013868","kind":"vulnerability","title":"Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-hr73-3gpv-hh6q","CVE-2026-81515"],"plain_summary":"GitHub lists this reviewed advisory for Steeltoe.Discovery.Eureka. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-12d0af4029fd75372322e21a618b8389"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-17T20:30:48.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-129647c15a43e76f556df5dd70e5da3e"},{"kind":"EPSS","as_of":"2026-11-02T12:00:30.000Z","value":"0.609%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.49167. Missing scores are unknown.","source_id":"sr-12d0af4029fd75372322e21a618b8389"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-129647c15a43e76f556df5dd70e5da3e","url":"https://github.com/advisories/GHSA-hr73-3gpv-hh6q","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-hr73-3gpv-hh6q","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T14:29:49.409Z"},{"id":"sr-12d0af4029fd75372322e21a618b8389","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-81515","publisher":"FIRST EPSS","observed_at":"2026-11-02T20:17:01.142Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-129647c15a43e76f556df5dd70e5da3e"],"technology":"Steeltoe.Discovery.Eureka","known_exclusions":[],"conditions_summary":"## Summary\n\nSteeltoe's Eureka discovery client deserializes the registry response as a single unit. If any registered instance contains a field value that cannot be parsed (for example, an unrecognized `actionType`, a non-boolean value for `isCoordinatingDiscoveryServer`, or a non-numeric timestamp), deserialization of the entire registry fails. All Steeltoe Eureka clients connected to that registry then receive an empty or stale instance list until the malformed registration is removed.\n\nThis is a related but distinct issue from CVE-2026-50196, which addressed only the `DataCenterInfo.name` field.\n\n## Impact\n\nAny principal that can register or update a service instance in the Eureka registry can trigger a service-discovery outage for all Steeltoe applications connected to the same registry. The outage persists until the offending registration is removed.\n\n## Affected configuration\n\n* Application uses `EurekaDiscoveryClient` (any deployment, including self-hosted Eureka).\n* The registry contains at least one service instance with an unrecognized value in a field such as `actionType`, `status`, `isCoordinatingDiscoveryServer`, or ","public_affected_ranges":[">= 4.0.0, <= 4.2.0"]}],"null_published_at":"2026-11-04T10:04:47.613Z","source_updated_at":"2026-09-17T20:30:48.000Z","source_disclosed_at":"2026-09-17T20:30:45.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T14:29:49.409Z"},{"id":"NVI-00013868","kind":"vulnerability","title":"Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-hr73-3gpv-hh6q","CVE-2026-81515"],"plain_summary":"GitHub lists this reviewed advisory for Steeltoe.Discovery.Eureka. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-129647c15a43e76f556df5dd70e5da3e"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-17T20:30:48.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-129647c15a43e76f556df5dd70e5da3e"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-129647c15a43e76f556df5dd70e5da3e","url":"https://github.com/advisories/GHSA-hr73-3gpv-hh6q","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-hr73-3gpv-hh6q","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T14:29:49.409Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-129647c15a43e76f556df5dd70e5da3e"],"technology":"Steeltoe.Discovery.Eureka","known_exclusions":[],"conditions_summary":"## Summary\n\nSteeltoe's Eureka discovery client deserializes the registry response as a single unit. If any registered instance contains a field value that cannot be parsed (for example, an unrecognized `actionType`, a non-boolean value for `isCoordinatingDiscoveryServer`, or a non-numeric timestamp), deserialization of the entire registry fails. All Steeltoe Eureka clients connected to that registry then receive an empty or stale instance list until the malformed registration is removed.\n\nThis is a related but distinct issue from CVE-2026-50196, which addressed only the `DataCenterInfo.name` field.\n\n## Impact\n\nAny principal that can register or update a service instance in the Eureka registry can trigger a service-discovery outage for all Steeltoe applications connected to the same registry. The outage persists until the offending registration is removed.\n\n## Affected configuration\n\n* Application uses `EurekaDiscoveryClient` (any deployment, including self-hosted Eureka).\n* The registry contains at least one service instance with an unrecognized value in a field such as `actionType`, `status`, `isCoordinatingDiscoveryServer`, or ","public_affected_ranges":[">= 4.0.0, <= 4.2.0"]}],"null_published_at":"2026-11-02T10:00:37.163Z","source_updated_at":"2026-09-17T20:30:48.000Z","source_disclosed_at":"2026-09-17T20:30:45.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T14:29:49.409Z"}],"next_cursor":null,"snapshot_revision":"42594"}