CVE-2026-41708: Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability
In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled.
Affected versions: Spring Cloud Sleuth 3.1.0 through 3.1.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
org.springframework.cloud:spring-cloud-sleuth-instrumentationfrom your environment.Remove or uninstall the org.springframework.cloud:spring-cloud-sleuth-instrumentation dependency if it is not required to eliminate the vulnerable instrumentation.
- Configuration
Disable Spring TX instrumentation in your application configuration so Sleuth does not instrument Spring TX (avoid enabling Spring TX instrumentation).
Spring Cloud Sleuth (Spring TX instrumentation) Spring TX instrumentation = disabled - Operational
Audit your deployments and dependency manifests/build files for Spring Cloud Sleuth versions 3.1.0 through 3.1.13 and remediate any instances found (disable instrumentation or remove the dependency).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41708?
The severity of CVE-2026-41708 is rated as high with a score of 7.5.
How do I fix CVE-2026-41708?
To fix CVE-2026-41708, upgrade to the latest version of org.springframework.cloud:spring-cloud-sleuth-instrumentation that addresses the vulnerability.
What does CVE-2026-41708 affect?
CVE-2026-41708 affects applications using vulnerable versions of Spring Cloud Sleuth instrumentation in conjunction with Spring TX instrumentation.
What kind of vulnerability is CVE-2026-41708?
CVE-2026-41708 is a denial-of-service (DoS) vulnerability that can be triggered by specially crafted calls.
When was CVE-2026-41708 published?
CVE-2026-41708 was published on June 15, 2026.