SteeltoeOSS vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 202611

Newest CVEs

• CVE-2026-81515

  Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)

  SteeltoeOSS · security-advisories

  High7.5
• CVE-2026-81516

  Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)

  SteeltoeOSS · security-advisories

  High7.5
• CVE-2026-81868

  Steeltoe: Header-forwarded client cert lacks proof of private-key possession

  SteeltoeOSS · security-advisories

  Medium6.5
• CVE-2026-75523

  Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets

  SteeltoeOSS · security-advisories

  Medium5.9
• CVE-2026-50268

  Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding

  SteeltoeOSS · Steeltoe.Configuration.Encryption

  Low1.9
• CVE-2026-50267

  Steeltoe: TLS private keys written to /tmp with default permissions, never deleted

  SteeltoeOSS · Steeltoe.Configuration.Abstractions

  Medium4.7
• CVE-2026-50202

  Steeltoe's static JWKS cache shared across schemes and never invalidated

  SteeltoeOSS · Steeltoe.Security.Authentication.CloudFoundryBase

  Medium5.9
• CVE-2026-50201

  Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission

  SteeltoeOSS · Steeltoe.Management.Endpoint

  Medium6.5
• CVE-2026-50200

  Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords

  SteeltoeOSS · Steeltoe.Management.Endpoint

  High7.5
• CVE-2026-50196

  Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

  SteeltoeOSS · Steeltoe.Discovery.Eureka

  High7.5