CVE-2026-41708: Spring Cloud Sleuth Denial-of-Service Vulnerability (3.1.0–3.1.13)

Technical summary

The vulnerability exists in org.springframework.cloud:spring-cloud-sleuth-instrumentation when Spring TX instrumentation is not explicitly disabled. An attacker can send crafted requests that cause excessive resource consumption or unhandled exceptions in the transaction tracking code, leading to application unavailability. The root cause is an improper handling of transaction contexts during span creation and propagation, allowing a path to uncontrolled resource exhaustion (CWE-400). The attack requires no authentication or user interaction and is network-accessible.

Business impact

A successful attack renders affected applications unresponsive, disrupting business operations and customer-facing services. Unlike vulnerabilities requiring authentication, this flaw can be exploited by any network-connected attacker, making it a significant availability risk. Recovery typically requires application restart, and repeated attacks can sustain outages. Organizations should prioritize patching to restore service resilience.

Affected systems

Spring Cloud Sleuth versions 3.1.0 through 3.1.13 are vulnerable. Applications must be actively using the spring-cloud-sleuth-instrumentation module with Spring TX instrumentation enabled (the default state). Earlier versions (before 3.1.0) and versions 3.1.14 and later are unaffected. Non-Spring transaction frameworks bypass this risk even if Sleuth is present.

Exploitability

Exploitability is straightforward. The vulnerability requires only network access and no credentials. Attack complexity is low—an attacker needs only to craft and transmit malformed or edge-case requests that trigger improper transaction handling. There is no Known Exploited Vulnerabilities (KEV) entry at this time, but the low barrier to exploitation means active scanning and exploitation attempts are likely to emerge as awareness spreads.

Remediation

Upgrade spring-cloud-sleuth-instrumentation to version 3.1.14 or later (verify against the vendor advisory for exact patch versions). As an interim control, disable Spring TX instrumentation by setting the appropriate configuration property to false if upgrading is not immediately possible, though this may limit transaction tracing capabilities. Test patches in non-production environments first to ensure compatibility with custom span processors or interceptors.

Patch guidance

Contact Broadcom or consult the official Spring Cloud release notes to identify the exact patched version for your minor release line. Patches are typically cumulative; upgrading to the latest 3.1.x or moving to the next stable major release line (e.g., 3.2.x if available) is recommended. Validate patch compatibility with other Spring Cloud components in your architecture before deployment. Review your dependency management tool (Maven, Gradle) to ensure the updated version is correctly resolved across your application stack.

Detection guidance

Monitor application logs for repeated transaction instrumentation errors, sudden spikes in thread pool exhaustion, or unexpected OutOfMemory exceptions in the Sleuth-instrumented code paths. Set up alerts for application restart events or health check failures that correlate with incoming API traffic patterns. Network-based detection can identify repeated requests to endpoints that trigger the vulnerability by observing error patterns or response timeouts. Consider implementing rate limiting on public endpoints as a temporary mitigation while patches are deployed.

Why prioritize this

This vulnerability scores HIGH (CVSS 7.5) due to its network accessibility, low attack complexity, and direct impact on availability. The absence of a KEV entry does not diminish urgency—the simplicity of exploitation means adversaries will likely discover and weaponize it. Any organization providing production services via affected Sleuth versions should treat this as a near-term priority, particularly if their transaction instrumentation is enabled and not explicitly disabled.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a network-accessible denial-of-service condition with no authentication required and low attack complexity. The lack of confidentiality or integrity impact (only availability is affected) prevents a critical rating, but the ease of triggering and the potential for sustained outages justify the HIGH severity. Real-world impact is amplified for organizations with no rapid patching process or those relying on Sleuth for observability in mission-critical transaction flows.

Frequently asked questions