CVE-2026-41710: Cache Exhaustion in Stateful Retries leads to Denial of Service
An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.
Affected versions: Spring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41710?
CVE-2026-41710 has a medium severity rating of 5.9.
What impact does CVE-2026-41710 have?
CVE-2026-41710 can lead to a Denial of Service by exhausting the stateful retry cache.
How do I fix CVE-2026-41710?
To fix CVE-2026-41710, you should update to the latest version of the Spring Retry library.
What systems are affected by CVE-2026-41710?
CVE-2026-41710 affects applications using the Maven org.springframework.retry/spring-retry library.
What kind of attack does CVE-2026-41710 facilitate?
CVE-2026-41710 allows an attacker to craft requests that overwhelm the application with a Denial of Service attack.