CVE-2026-81515

Katalog CVE

CVSS 7.5 · High EPSS 0,61%

Kerentanan Improper Handling of Exceptional Conditions. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, EurekaDiscoveryClient deserializes the registry response as one unit, and an unrecognized actionType or status, a non-Boolean isCoordinatingDiscoveryServer, or a nonnumeric timestamp can abort the entire response. A principal that can register or update an instance can cause all connected Steeltoe clients to receive an empty or stale instance list until the malformed registration is removed. The JsonInstanceInfoConverter, BoolStringJsonConverter, and LongStringJsonConverter parsing paths are affected. This issue is distinct from the earlier DataCenterInfo.name parsing vulnerability. This issue is fixed in version 4.3.0.

Rincian

Terbit di NVD

17 September 2026

Terakhir diubah

24 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-755: Improper Handling of Exceptional Conditions

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/SteeltoeOSS/Steeltoe/commit/bc1c3763aacc1fee82ef9932f338ec08dcb00432
• https://github.com/SteeltoeOSS/Steeltoe/releases/tag/4.3.0
• https://github.com/SteeltoeOSS/security-advisories/security/advisories/GHSA-hr73-3gpv-hh6q