CVE-2026-41710: Spring Retry has Cache Exhaustion in Stateful Retries that leads to Denial of Service
(updated )
An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.
Affected versions: Spring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4.
References
- github.com/advisories/GHSA-2827-2mxx-j8pv
- github.com/spring-attic/spring-retry/commit/6f351edae3d3575fffbde3c0f62fef963dacd152
- github.com/spring-attic/spring-retry/issues/505
- github.com/spring-attic/spring-retry/releases/tag/v2.0.13
- nvd.nist.gov/vuln/detail/CVE-2026-41710
- spring.io/security/cve-2026-41710
Code Behaviors & Features
Detect and mitigate CVE-2026-41710 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →