High severity7.5NVD Advisory· Published Jun 15, 2026· Updated Jun 16, 2026
CVE-2026-41708
CVE-2026-41708
Description
In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled.
Affected versions: Spring Cloud Sleuth 3.1.0 through 3.1.13.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.springframework.cloud:spring-cloud-sleuth-instrumentationMaven | >= 3.1.0, <= 3.1.11 | — |
Affected products
2- Range: >=3.1.0, <=3.1.13
- ghsa-coordsRange: >= 3.1.0, <= 3.1.11
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-26m2-9g2q-v45qghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-41708ghsaADVISORY
- spring.io/security/cve-2026-41708nvdWEB
News mentions
1- Spring Projects: Three High-Severity CVEs Disclosed Across Cloud Gateway, AI Vector Stores, and SleuthVypr Intelligence · Jun 15, 2026