What is the CVSS score of CVE-2026-41708?

CVE-2026-41708 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of Spring Cloud Sleuth are affected by CVE-2026-41708?

Spring Cloud Sleuth versions 3.1.0 through 3.1.13 contain a network-reachable denial-of-service vulnerability affecting applications with transaction instrumentation enabled.. A patch is available.

How to fix or mitigate CVE-2026-41708?

Within 24 hours: identify all deployments running Spring Cloud Sleuth 3.1.0-3.1.13 with spring-cloud-sleuth-instrumentation TX instrumentation active. Within 7 days: disable TX instrumentation if operationally feasible, or deploy network-based rate limiting on affected endpoints. Within 30 days: monitor Spring Cloud Sleuth vendor releases; upgrade to Spring Cloud Sleuth 3.1.14 or later when patch is released.

Spring Cloud Sleuth CVE-2026-41708

EUVD-2026-36797 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-15 vmware

GHSA-26m2-9g2q-v45q

Java Denial Of Service Spring Cloud Sleuth

7.5

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable DoS via crafted calls to default-enabled TX instrumentation; no auth or UI required, availability-only impact, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 15, 2026 - 21:01 EUVD

Analysis Generated

Jun 15, 2026 - 19:56 vuln.today

DescriptionCVE.org

In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled.

Affected versions: Spring Cloud Sleuth 3.1.0 through 3.1.13.

Articles & Coverage 2

News 3 New Java Vulnerabilities - 3 High Severity Jun 16, 2026 News 3 New Java Vulnerabilities - 3 High Severity, No Public Exploits Jun 15, 2026

AnalysisAI

Denial-of-service in Spring Cloud Sleuth 3.1.0 through 3.1.13 allows remote unauthenticated attackers to exhaust application availability by sending specially crafted calls processed by the spring-cloud-sleuth-instrumentation library when Spring TX (transaction) instrumentation is enabled. The flaw is network-reachable with low attack complexity and no user interaction (CVSS 7.5, AV:N/AC:L/PR:N), but there is no public exploit identified at time of analysis and no CISA KEV listing. Impact is limited to availability - no confidentiality or integrity compromise is possible.

Technical ContextAI

Spring Cloud Sleuth is a distributed-tracing library for Spring Boot/Cloud applications that auto-instruments components (HTTP, messaging, transactions) to propagate trace and span IDs. The vulnerable component is org.springframework.cloud:spring-cloud-sleuth-instrumentation, specifically the Spring TX (transaction) instrumentation module that wraps Spring's PlatformTransactionManager to record transactional spans. The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), meaning crafted inputs cause the tracing instrumentation to consume resources (CPU, memory, threads, or span buffers) disproportionately, eventually starving the application. Sleuth 3.1.x is the last maintenance line - the project has been superseded upstream by Micrometer Tracing in Spring Boot 3.x, which affects upgrade paths.

RemediationAI

Upstream fix available per the Spring advisory at https://spring.io/security/cve-2026-41708; an exact fixed version was not provided in the input data, so consult the advisory for the patched 3.1.x release or the recommended migration target. The primary remediation is to upgrade spring-cloud-sleuth-instrumentation to the patched version published by VMware/Broadcom, ideally as part of moving to Micrometer Tracing on Spring Boot 3.x since Sleuth 3.1 is end-of-life. As an immediate workaround if patching is blocked, disable Spring TX instrumentation by setting spring.sleuth.tx.enabled=false in application properties - this eliminates the vulnerable code path at the cost of losing transactional spans in distributed traces, which reduces visibility into @Transactional boundaries but does not affect HTTP or messaging tracing. Additionally, place rate limiting or a WAF in front of exposed endpoints that fan out into transactional code to blunt resource-exhaustion attempts.