Vulnerability · Published Jun 9, 2026 · Assigned by vmware
CVE-2026-41710Cache Exhaustion in Stateful Retries leads to Denial of Service
Medium 5.9
In plain English
A medium-severity resource allocation without limits in Spring Retry from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail. Affected versions: Spring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.retry:spring-retry | 2.0.13 | GHSA-2827-2mxx-j8pv |
| Maven | org.springframework.retry:spring-retry | no fix listed | GHSA-2827-2mxx-j8pv |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Retry | 2.0.0 – before 2.0.12.11.3.0 – before 1.3.5 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H