CVE-2026-41708: Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability

June 15, 2026 (updated August 26, 2026)

In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled.

Affected versions: Spring Cloud Sleuth 3.1.0 through 3.1.13.

References

github.com/advisories/GHSA-26m2-9g2q-v45q
nvd.nist.gov/vuln/detail/CVE-2026-41708
spring.io/security/cve-2026-41708

Code Behaviors & Features

Detect and mitigate CVE-2026-41708 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →