CVE-2026-41708

{
  "id": "CVE-2026-41708",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-15T20:16:27.940",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled.\n\nAffected versions:\nSpring Cloud Sleuth 3.1.0 through 3.1.13."
    },
    {
      "lang": "es",
      "value": "En Spring Cloud Sleuth, es posible que un usuario proporcione llamadas especialmente diseñadas que pueden causar una condición de denegación de servicio (DoS). La aplicación es vulnerable cuando utiliza una versión vulnerable de org.springframework.cloud:spring-cloud-sleuth-instrumentation y la instrumentación de Spring TX no está deshabilitada.\n\nVersiones afectadas:\nSpring Cloud Sleuth 3.1.0 hasta 3.1.13."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Spring",
          "product": "Spring Cloud Sleuth",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "3.1.0",
              "lessThan": "3.1.14",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-15T20:06:15.787096Z",
          "id": "CVE-2026-41708",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:broadcom:spring_cloud_sleuth:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "3.1.0",
              "versionEndExcluding": "3.1.14",
              "matchCriteriaId": "A0A05198-3BD0-4512-A353-F1E0020CFA42"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://spring.io/security/cve-2026-41708",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}