CVE-2026-41708: Spring Cloud Sleuth DoS Vulnerability

CVE-2026-41708 Overview

CVE-2026-41708 is a denial-of-service (DoS) vulnerability in Spring Cloud Sleuth, a distributed tracing library maintained by Broadcom. Attackers can send specially crafted calls that trigger excessive resource consumption when the application uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation with Spring TX (transaction) instrumentation enabled. The flaw is classified as [CWE-400] Uncontrolled Resource Consumption. Spring Cloud Sleuth versions 3.1.0 through 3.1.13 are affected. The vulnerability is remotely exploitable over the network without authentication or user interaction, impacting application availability.

Critical Impact
Unauthenticated remote attackers can exhaust server resources, rendering Spring-based microservices unavailable to legitimate users.

Affected Products

Broadcom Spring Cloud Sleuth 3.1.0 through 3.1.13
Applications using org.springframework.cloud:spring-cloud-sleuth-instrumentation
Spring services with Spring TX instrumentation enabled

Discovery Timeline

2026-06-15 - CVE-2026-41708 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-41708

Vulnerability Analysis

Spring Cloud Sleuth provides distributed tracing for Spring Boot applications, automatically instrumenting components such as HTTP clients, messaging frameworks, and transactional code paths. The vulnerability resides in the Spring TX (transaction) instrumentation logic within the spring-cloud-sleuth-instrumentation module. When this instrumentation processes specially crafted requests that interact with transactional code, it consumes excessive system resources. The result is a denial-of-service condition that prevents the application from handling legitimate traffic.

The attack targets availability exclusively. Confidentiality and integrity are not affected. However, microservices that depend on the affected Spring service may experience cascading failures, amplifying the operational impact across distributed systems.

Root Cause

The root cause is uncontrolled resource consumption [CWE-400] in the Spring TX instrumentation path. Sleuth wraps transactional operations to add tracing spans. Crafted inputs cause this instrumentation to generate or process tracing data in a manner that consumes disproportionate CPU, memory, or thread resources relative to the input size. The instrumentation does not enforce upper bounds on the work performed during span creation, allowing attackers to weaponize ordinary application endpoints.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends crafted HTTP or RPC requests to any endpoint of a vulnerable Spring application whose code path passes through Spring TX-instrumented logic. Because Sleuth instrumentation is typically enabled by default for transactional beans, most production deployments using affected versions are exposed without additional configuration. Detailed exploitation specifics are documented in the Spring Security Advisory for CVE-2026-41708.

Detection Methods for CVE-2026-41708

Indicators of Compromise

Sudden spikes in CPU or heap utilization on Spring Boot services without corresponding traffic volume increases
Elevated thread counts or thread-pool exhaustion in services using spring-cloud-sleuth-instrumentation
Application response latency degradation correlated with bursts of incoming requests to transactional endpoints
Out-of-memory errors or garbage collection storms in JVM metrics for instrumented services

Detection Strategies

Inventory dependencies across application repositories and container images to identify spring-cloud-sleuth-instrumentation versions 3.1.0 through 3.1.13
Monitor JVM metrics (CPU, heap, GC pauses, thread counts) and correlate anomalies with inbound request patterns
Inspect distributed tracing backends for abnormally large or malformed spans originating from TX-instrumented code paths
Use software composition analysis (SCA) tooling in CI/CD pipelines to flag vulnerable Sleuth versions before deployment

Monitoring Recommendations

Set alerts on sustained CPU above 85% or heap usage above 90% in instrumented services
Log and rate-limit requests by source IP at the ingress layer to detect repeated DoS attempts
Forward JVM and application telemetry to a centralized analytics platform for cross-service correlation
Track HTTP 5xx rates and request timeouts as leading indicators of resource exhaustion

How to Mitigate CVE-2026-41708

Immediate Actions Required

Upgrade spring-cloud-sleuth-instrumentation to a fixed version as indicated in the Spring security advisory
If upgrading is not immediately possible, disable Spring TX instrumentation in Sleuth configuration
Deploy a web application firewall (WAF) or rate-limiting policy in front of exposed Spring services
Audit dependency manifests across all microservices to identify every affected instance

Patch Information

Broadcom has published remediation guidance in the Spring Security Advisory for CVE-2026-41708. Spring Cloud Sleuth 3.1.x reached end-of-life status; teams should consult the advisory for the recommended upgrade path or migration to Micrometer Tracing, the successor project. Applications running versions prior to 3.1.0 are not affected by this specific issue.

Workarounds

Disable Spring TX instrumentation by setting spring.sleuth.tx.enabled=false in application properties
Restrict network access to internal-only services using network policies or service mesh authorization rules
Implement request size and rate limits at the API gateway to reduce attack surface
Apply circuit breakers and bulkhead patterns to contain resource exhaustion within affected services

bash

# Configuration example: disable Spring TX instrumentation in application.properties
spring.sleuth.tx.enabled=false

# Or in application.yml
# spring:
#   sleuth:
#     tx:
#       enabled: false