CVE-2026-50196

Name of the Vulnerable Software and Affected Versions Steeltoe.Discovery.Eureka versions prior to 3.4.0 Steeltoe.Discovery.Eureka versions prior to 4.2.0

Description The DataCenterInfo.FromJson() function throws an ArgumentException when it encounters any name value other than "MyOwn" or "Amazon". This occurs because the implementation fails to recognize "Netflix" as a valid value, despite it being defined in the Java Eureka specification. This unhandled exception propagates through the registry deserialization chain and is swallowed by the periodic cache refresh task, which results in the local service registry becoming permanently empty or stale, leading to a Denial of Service (DoS) condition.

Recommendations Update to version 3.4.0. Update to version 4.2.0. Remove any registrations using unsupported DataCenterInfo.name values from the registry. In mixed Java/Spring and Steeltoe environments, audit for the Netflix data center type before deploying Steeltoe Eureka clients.