CVE-2026-41710: Spring Retry DoS Vulnerability

CVE-2026-41710 Overview

CVE-2026-41710 is a denial of service vulnerability in Spring Retry affecting versions 2.0.0 through 2.0.12 and 1.3.0 through 1.3.4. The flaw resides in the application-wide stateful retry cache, which has no eviction policy when full. An attacker can issue a large volume of unique requests that trigger retry failures, filling the cache until it permanently rejects further updates. Once exhausted, all subsequent stateful retries and circuit breakers in the application fail. The issue is categorized under [CWE-770] (Allocation of Resources Without Limits or Throttling).

Critical Impact
Permanent failure of stateful retry and circuit breaker functionality across the application, leading to availability loss until the process is restarted.

Affected Products

Spring Retry 2.0.0 through 2.0.12
Spring Retry 1.3.0 through 1.3.4
Applications embedding Spring Retry for resilience patterns

Discovery Timeline

2026-06-09 - CVE-2026-41710 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-41710

Vulnerability Analysis

Spring Retry provides declarative retry support for Spring applications, including stateful retry semantics that persist failure state across invocations. To track retry attempts for stateful operations, the framework maintains an application-wide cache keyed by a caller-supplied identifier. The cache stores RetryContext entries for in-flight stateful retry operations and circuit breaker states.

The cache implementation enforces a fixed capacity but does not evict stale or completed entries when that capacity is reached. When the cache fills, subsequent insertions are silently rejected. Because the cache is shared across the entire application, the rejection affects every component that depends on stateful retry or circuit breaker logic.

The attack does not require authentication, network access alone is sufficient, and the impact is limited to availability. The vulnerability has high attack complexity because the attacker must generate many unique cache keys, each triggering a retry failure path.

Root Cause

The root cause is unbounded allocation of resources within a bounded cache without an eviction or aging policy. Failed retry contexts accumulate until the capacity is hit, after which the cache enters a permanently degraded state. The design assumes cooperative clients that complete their retry cycles, allowing entries to be cleared naturally.

Attack Vector

An attacker crafts requests with distinct cache keys, such as varying input parameters that map onto unique RetryContext identifiers. Each request must reach a code path protected by stateful retry and must fail in a way that leaves an entry in the cache. By repeating this pattern, the attacker fills the cache. After exhaustion, legitimate requests that rely on retry or circuit breaker logic are denied service until the application is restarted.

No verified public exploit code is available. See the Spring Security Advisory CVE-2026-41710 for vendor technical details.

Detection Methods for CVE-2026-41710

Indicators of Compromise

Sustained high volume of inbound requests carrying unique parameter values that map to retry-protected endpoints.
Application logs showing repeated failures inside Spring Retry interceptors followed by silent rejection of new retry contexts.
Circuit breakers entering and remaining in a failed or open state across unrelated downstream services.

Detection Strategies

Instrument Spring Retry to expose cache size as a metric and alert when it approaches the configured maximum.
Correlate spikes in retry exceptions with growth in unique request keys to identify enumeration patterns.
Track latency and error rates for endpoints wrapped by @Retryable or CircuitBreakerRetryPolicy annotations.

Monitoring Recommendations

Export JVM and Spring Retry metrics through Micrometer to a centralized observability platform.
Add synthetic probes that exercise stateful retry paths to detect when the cache stops accepting updates.
Alert on prolonged circuit breaker open states that do not correlate with downstream service incidents.

How to Mitigate CVE-2026-41710

Immediate Actions Required

Upgrade Spring Retry to a fixed release line above 2.0.12 or 1.3.4 per the vendor advisory.
Inventory all applications and libraries that transitively depend on Spring Retry and prioritize internet-facing services.
Apply rate limiting and input validation on endpoints that drive stateful retry logic.

Patch Information

Refer to the Spring Security Advisory CVE-2026-41710 for the list of fixed versions and upgrade guidance. The fix introduces bounded handling of the stateful retry cache so that exhaustion no longer produces a permanent denial of service state.

Workarounds

Restrict the set of cache keys by deriving them from authenticated, server-controlled identifiers rather than attacker-influenced inputs.
Reduce reliance on application-wide stateful retry where idempotent stateless retry is sufficient.
Schedule periodic application restarts as a temporary measure where patching is not immediately possible.

bash

# Maven dependency update example
mvn versions:use-dep-version -Dincludes=org.springframework.retry:spring-retry -DdepVersion=2.0.13 -DforceVersion=true