Vulnerability Details CVE-2026-41708
In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled.
Affected versions:
Spring Cloud Sleuth 3.1.0 through 3.1.13.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 36.3%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-41708
-
cpe:2.3:a:broadcom:spring_cloud_sleuth:3.1.0
-
cpe:2.3:a:broadcom:spring_cloud_sleuth:3.1.1
-
cpe:2.3:a:broadcom:spring_cloud_sleuth:3.1.10
-
cpe:2.3:a:broadcom:spring_cloud_sleuth:3.1.11
-
cpe:2.3:a:broadcom:spring_cloud_sleuth:3.1.12
-
cpe:2.3:a:broadcom:spring_cloud_sleuth:3.1.13
-
cpe:2.3:a:broadcom:spring_cloud_sleuth:3.1.2
-
cpe:2.3:a:broadcom:spring_cloud_sleuth:3.1.3
-
cpe:2.3:a:broadcom:spring_cloud_sleuth:3.1.4
-
cpe:2.3:a:broadcom:spring_cloud_sleuth:3.1.5
-
cpe:2.3:a:broadcom:spring_cloud_sleuth:3.1.6
-
cpe:2.3:a:broadcom:spring_cloud_sleuth:3.1.7
-
cpe:2.3:a:broadcom:spring_cloud_sleuth:3.1.8
-
cpe:2.3:a:broadcom:spring_cloud_sleuth:3.1.9