CVE-2026-41708 — Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability

CVE-2026-41708

Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability PUBLISHED

Description (CNA)

In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled. Affected versions: Spring Cloud Sleuth 3.1.0 through 3.1.13.

Affected (CNA)

Vendor / product	Versions
Spring / Spring Cloud Sleuth	affected 3.1.0 before 3.1.14

CWE

CWE-400

References

https://spring.io/security/cve-2026-41708

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.