PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41708 Spring CVE debrief

CVE-2026-41708 is a HIGH severity vulnerability in Spring Cloud Sleuth, with a CVSS score of 7.5. The vulnerability allows a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled. Affected versions include Spring Cloud Sleuth 3.1.0 through 3.1.13.

Vendor
Spring
Product
Spring Cloud Sleuth
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-17
Advisory published
2026-06-15
Advisory updated
2026-06-17

Who should care

Users of Spring Cloud Sleuth 3.1.0 through 3.1.13

Technical summary

In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade to a non-vulnerable version of Spring Cloud Sleuth
  • Disable Spring TX instrumentation if not required

Evidence notes

The CVE record was published on 2026-06-15T20:16:27.940Z and has not been modified since.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-41708 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-41708

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-41708 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-41708

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.