CVE-2026-41708

In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled. Affected versions: Spring Cloud Sleuth 3.1.0 through 3.1.13.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://spring.io/security/cve-2026-41708	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:broadcom:spring_cloud_sleuth:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) En Spring Cloud Sleuth, es posible que un usuario proporcione llamadas especialmente diseñadas que pueden causar una condición de denegación de servicio (DoS). La aplicación es vulnerable cuando utiliza una versión vulnerable de org.springframework.cloud:spring-cloud-sleuth-instrumentation y la instrumentación de Spring TX no está deshabilitada. Versiones afectadas: Spring Cloud Sleuth 3.1.0 hasta 3.1.13.

Information

Published : 2026-06-15 20:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-41708

Mitre link : CVE-2026-41708

CVE.ORG link : CVE-2026-41708

JSON object : View

Products Affected

broadcom

spring_cloud_sleuth

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-41708", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41708", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T20:06:15.787096Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "Spring", "product": "Spring Cloud Sleuth", "versions": [{"status": "affected", "version": "3.1.0", "lessThan": "3.1.14", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-15T20:16:27.940", "references": [{"url": "https://spring.io/security/cve-2026-41708", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled.\n\nAffected versions:\nSpring Cloud Sleuth 3.1.0 through 3.1.13."}, {"lang": "es", "value": "En Spring Cloud Sleuth, es posible que un usuario proporcione llamadas especialmente dise\u00f1adas que pueden causar una condici\u00f3n de denegaci\u00f3n de servicio (DoS). La aplicaci\u00f3n es vulnerable cuando utiliza una versi\u00f3n vulnerable de org.springframework.cloud:spring-cloud-sleuth-instrumentation y la instrumentaci\u00f3n de Spring TX no est\u00e1 deshabilitada.\n\nVersiones afectadas:\nSpring Cloud Sleuth 3.1.0 hasta 3.1.13."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:broadcom:spring_cloud_sleuth:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0A05198-3BD0-4512-A353-F1E0020CFA42", "versionEndExcluding": "3.1.14", "versionStartIncluding": "3.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}