CyberRota Analysis
AI-GeneratedSteeltoe versions 4.0.0 to 4.3.0 are vulnerable due to improper deserialization in the EurekaDiscoveryClient, which can lead to all connected clients receiving an empty or stale instance list when a malformed registration occurs. This vulnerability can disrupt cloud-native application functionality, making it critical for organizations using affected versions to upgrade to 4.3.0 or later to mitigate potential service disruptions. Users managing Steeltoe-based applications should prioritize this update to ensure operational integrity and security.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, EurekaDiscoveryClient deserializes the registry response as one unit, and an unrecognized actionType or status, a non-Boolean isCoordinatingDiscoveryServer, or a nonnumeric timestamp can abort the entire response. A principal that can register or update an instance can cause all connected Steeltoe clients to receive an empty or stale instance list until the malformed registration is removed. The JsonInstanceInfoConverter, BoolStringJsonConverter, and LongStringJsonConverter parsing paths are affected. This issue is distinct from the earlier DataCenterInfo.name parsing vulnerability. This issue is fixed in version 4.3.0.