{"id":"CVE-2026-41710","summary":"Cache Exhaustion in Stateful Retries leads to Denial of Service","details":"An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.\n\nAffected versions:\nSpring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4.","aliases":["GHSA-2827-2mxx-j8pv"],"modified":"2026-09-12T03:46:16.818484486Z","published":"2026-06-09T03:48:15.972Z","database_specific":{"cna_assigner":"vmware","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41710.json","unresolved_ranges":[{"extracted_events":[{"introduced":"2.0.0"},{"fixed":"2.0.12.1"},{"introduced":"1.3.0"},{"fixed":"1.3.5"}],"source":"AFFECTED_FIELD"},{"extracted_events":[{"introduced":"2.0.0"},{"fixed":"2.0.12"},{"introduced":"1.3.0"},{"fixed":"1.3.4"}],"source":"DESCRIPTION"}]},"references":[{"type":"WEB","url":"https://spring.io/security/cve-2026-41710"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41710.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41710"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/spring-attic/spring-retry","events":[{"introduced":"ef297179e3e1ba88a7b4abef1a9faca5deb1f03a"},{"fixed":"802c4450ce5850588947bbd8d2830f6f07a6076a"},{"introduced":"fee59a15ede03ad5d166e8696d429df9684e07d9"},{"fixed":"65cb556fd312095e0d1d5af98b0acf483b549fef"}],"database_specific":{"extracted_events":[{"introduced":"2.0.0"},{"fixed":"2.0.12"},{"introduced":"1.3.0"},{"fixed":"1.3.4"}],"source":"DESCRIPTION"}}],"versions":["1.3.1.RELEASE","1.3.0.RELEASE"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41710.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}