CVE-2026-41708: high-severity vulnerability in Spring Cloud Sleuth
Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability
Published
Follow this CVE+ Monitor Spring Cloud Sleuth+ Monitor org.springframework.cloud:spring-cloud-sleuth-instrumentation
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.3%
In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled.
Affected versions:
Spring Cloud Sleuth 3.1.0 through 3.1.13.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Spring · Spring Cloud Sleuth