MEDIUMCVSS 5.9EPSS 0.3%

CVE-2026-41710

CVE-2026-41710 updated by NVD

Published: 2026-06-09
Modified: 2026-07-29
EPSS percentile: 20%
Sources: github-advisory, nvd

Summary

An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail. Affected versions: Spring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Maven	org.springframework.retry:spring-retry	—	2.0.13

Remediation: Upgrade to 2.0.13 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-41710

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.