Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

3 vulnerabilities found for Spring Retry by Spring

CVE-2026-41710 (GCVE-0-2026-41710)

Vulnerability from nvd – Published: 2026-06-09 03:48 – Updated: 2026-06-09 13:44
VLAI
Title
Cache Exhaustion in Stateful Retries leads to Denial of Service
Summary
An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail. Affected versions: Spring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4.
Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
Vendor Product Version
Spring Spring Retry Affected: 2.0.0 , < 2.0.13 (custom)
Affected: 1.3.0 , < 1.3.5 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41710",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T13:43:54.447108Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T13:44:01.295Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Retry",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "2.0.13",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.3.5",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.\n\nAffected versions:\nSpring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4."
            }
          ],
          "value": "An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.\n\nAffected versions:\nSpring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker can exhaust the stateful retry cache by crafting unique failing requests, permanently preventing further stateful retries and circuit breakers from functioning, resulting in denial of service."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T03:48:15.972Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41710"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cache Exhaustion in Stateful Retries leads to Denial of Service",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41710",
    "datePublished": "2026-06-09T03:48:15.972Z",
    "dateReserved": "2026-04-22T06:21:34.490Z",
    "dateUpdated": "2026-06-09T13:44:01.295Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41710 (GCVE-0-2026-41710)

Vulnerability from cvelistv5 – Published: 2026-06-09 03:48 – Updated: 2026-06-09 13:44
VLAI
Title
Cache Exhaustion in Stateful Retries leads to Denial of Service
Summary
An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail. Affected versions: Spring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4.
Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
Impacted products
Vendor Product Version
Spring Spring Retry Affected: 2.0.0 , < 2.0.13 (custom)
Affected: 1.3.0 , < 1.3.5 (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41710",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T13:43:54.447108Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T13:44:01.295Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Retry",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "2.0.13",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.3.5",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.\n\nAffected versions:\nSpring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4."
            }
          ],
          "value": "An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.\n\nAffected versions:\nSpring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker can exhaust the stateful retry cache by crafting unique failing requests, permanently preventing further stateful retries and circuit breakers from functioning, resulting in denial of service."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T03:48:15.972Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-41710"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Cache Exhaustion in Stateful Retries leads to Denial of Service",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-41710",
    "datePublished": "2026-06-09T03:48:15.972Z",
    "dateReserved": "2026-04-22T06:21:34.490Z",
    "dateUpdated": "2026-06-09T13:44:01.295Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CERTFR-2026-AVI-0705

Vulnerability from certfr_avis - Published: 2026-06-09 - Updated: 2026-06-09

De multiples vulnérabilités ont été découvertes dans les produits Spring. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
Spring Spring Retry Retry versions 1.3.x antérieures à 1.3.5
Spring Reactor Netty Reactor Netty versions 1.0.x antérieures à 1.0.52 (Reactor BOM 2020.0.51)
Spring Spring REST Docs REST Docs versions 2.0.x antérieures à 2.0.9
Spring Spring REST Docs REST Docs versions 3.0.x antérieures à 3.0.6 (source ouverte) ou 3.0.5.1 (licence commerciale)
Spring Reactor Netty Reactor Netty versions 1.3.x antérieures à 1.3.6 (Reactor BOM 2025.0.6)
Spring Spring Retry Retry versions 2.0.x antérieures à 2.0.13
Spring Spring LDAP LDAP versions 3.2.x antérieures à 3.2.18
Spring Spring Framework Framework versions 6.2.x antérieures à 6.2.19 (source ouverte) ou 6.2.18.1 (licence commerciale)
Spring Reactor Netty Reactor Netty versions 1.1.x antérieures à 1.1.36 (Reactor BOM 2023.0.24)
Spring Spring Framework Framework versions 7.0.x antérieures à 7.0.8 (source ouverte) ou 7.0.7.1 (licence commerciale)
Spring Spring LDAP LDAP versions 2.4.x antérieures à 2.4.5
Spring Spring LDAP LDAP versions 3.3.x antérieures à 3.3.8
Spring Spring REST Docs REST Docs versions 4.0.x antérieures à 4.0.1 (source ouverte) ou 4.0.0.1 (licence commerciale)
Spring Spring LDAP LDAP versions 4.0.x antérieures à 4.0.4
Spring Reactor Netty Reactor Netty versions 1.2.x antérieures à 1.2.18 (Reactor BOM 2024.0.18)
Spring Spring Framework Framework versions 6.1.x antérieures à 6.1.28
Spring Spring Framework Framework versions 5.3.x antérieures à 5.3.49
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Retry versions 1.3.x ant\u00e9rieures \u00e0 1.3.5",
      "product": {
        "name": "Spring Retry",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Reactor Netty versions 1.0.x ant\u00e9rieures \u00e0 1.0.52 (Reactor BOM 2020.0.51)",
      "product": {
        "name": "Reactor Netty",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "REST Docs versions 2.0.x ant\u00e9rieures \u00e0 2.0.9",
      "product": {
        "name": "Spring REST Docs",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "REST Docs versions 3.0.x ant\u00e9rieures \u00e0 3.0.6 (source ouverte) ou 3.0.5.1 (licence commerciale)",
      "product": {
        "name": "Spring REST Docs",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Reactor Netty versions 1.3.x ant\u00e9rieures \u00e0 1.3.6 (Reactor BOM 2025.0.6)",
      "product": {
        "name": "Reactor Netty",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Retry versions 2.0.x ant\u00e9rieures \u00e0 2.0.13",
      "product": {
        "name": "Spring Retry",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "LDAP versions 3.2.x ant\u00e9rieures \u00e0 3.2.18",
      "product": {
        "name": "Spring LDAP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Framework versions 6.2.x ant\u00e9rieures \u00e0 6.2.19 (source ouverte) ou 6.2.18.1 (licence commerciale)",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Reactor Netty versions 1.1.x ant\u00e9rieures \u00e0 1.1.36 (Reactor BOM 2023.0.24)",
      "product": {
        "name": "Reactor Netty",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Framework versions 7.0.x ant\u00e9rieures \u00e0 7.0.8 (source ouverte) ou 7.0.7.1 (licence commerciale)",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "LDAP versions 2.4.x ant\u00e9rieures \u00e0 2.4.5",
      "product": {
        "name": "Spring LDAP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "LDAP versions 3.3.x ant\u00e9rieures \u00e0 3.3.8",
      "product": {
        "name": "Spring LDAP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "REST Docs versions 4.0.x ant\u00e9rieures \u00e0 4.0.1 (source ouverte) ou 4.0.0.1 (licence commerciale)",
      "product": {
        "name": "Spring REST Docs",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "LDAP versions 4.0.x ant\u00e9rieures \u00e0 4.0.4",
      "product": {
        "name": "Spring LDAP",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Reactor Netty versions 1.2.x ant\u00e9rieures \u00e0 1.2.18 (Reactor BOM 2024.0.18)",
      "product": {
        "name": "Reactor Netty",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Framework versions 6.1.x ant\u00e9rieures \u00e0 6.1.28",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    },
    {
      "description": "Framework versions 5.3.x ant\u00e9rieures \u00e0 5.3.49",
      "product": {
        "name": "Spring Framework",
        "vendor": {
          "name": "Spring",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-41710",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41710"
    },
    {
      "name": "CVE-2026-41839",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41839"
    },
    {
      "name": "CVE-2026-41844",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41844"
    },
    {
      "name": "CVE-2026-41715",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41715"
    },
    {
      "name": "CVE-2026-41842",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41842"
    },
    {
      "name": "CVE-2026-40991",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40991"
    },
    {
      "name": "CVE-2026-41720",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41720"
    },
    {
      "name": "CVE-2026-41843",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41843"
    },
    {
      "name": "CVE-2026-41841",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41841"
    },
    {
      "name": "CVE-2026-41838",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41838"
    },
    {
      "name": "CVE-2026-41840",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41840"
    }
  ],
  "initial_release_date": "2026-06-09T00:00:00",
  "last_revision_date": "2026-06-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0705",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-06-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Spring. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Spring",
  "vendor_advisories": [
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41839",
      "url": "https://spring.io/security/cve-2026-41839"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-40991",
      "url": "https://spring.io/security/cve-2026-40991/"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41710",
      "url": "https://spring.io/security/cve-2026-41710"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41844",
      "url": "https://spring.io/security/cve-2026-41844/"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41715",
      "url": "https://spring.io/security/cve-2026-41715"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41720",
      "url": "https://spring.io/security/cve-2026-41720"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41842",
      "url": "https://spring.io/security/cve-2026-41842"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41840",
      "url": "https://spring.io/security/cve-2026-41840"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41841",
      "url": "https://spring.io/security/cve-2026-41841"
    },
    {
      "published_at": "2026-06-09",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41843",
      "url": "https://spring.io/security/cve-2026-41843/"
    },
    {
      "published_at": "2026-06-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41838",
      "url": "https://spring.io/security/cve-2026-41838"
    }
  ]
}