Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

steeltoe.discovery.consul

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5NuGetAmendedPublished

    Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)

    CVE-2026-81516 · GHSA-67c9-f6v2-qv86

    Affected
    • NuGet steeltoe.discovery.consul >= 4.0.0, <= 4.2.0
    Fixed in
    4.3.0· Vendor fix available
    Issue
    Steeltoe's Consul discovery client parses the secure metadata field on each registered service instance using bool.Parse, which throws on any value other than true or false. A single service instance registered with a malformed secure value (for example yes or 1) aborts construction of the entire instance list for that service, making the service undiscoverable. When GetAllInstancesAsync is used, one malformed instance in any service can abort enumeration across all services. This is the same "one malformed field aborts the whole batch" availability class as CVE-2026-50196, but affecting the Consul discovery client. Impact Any principal that can register a service in the Consul catalog can trigger a service-discovery outage for all Steeltoe applications resolving that service. The outage affects all instances of the targeted service — not just the malformed one — and persists until the offending registration is removed. Affected configuration - Application uses…

    Recommended action: Upgrade to 4.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →