CVE-2026-41708: Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability

Synopsis

This is a denial-of-service vulnerability in Spring Cloud Sleuth, specifically its Spring TX instrumentation component (org.springframework.cloud:spring-cloud-sleuth-instrumentation). The flaw is reachable over the network with no authentication required and no victim interaction needed. A remote attacker can send specially crafted requests that trigger the vulnerable code path and crash or render the affected service unavailable. A patched-image rebuild at version 3.1.14 is available on HarborGuard for environments running an affected version (3.1.0 through 3.1.13).

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker sends crafted HTTP or RPC requests from any remote location.

• AuthenticationNot required

  No account or credential is needed; the crafted requests can be sent by any unauthenticated caller.

• Victim interactionNot required

  No user action is required; the attacker triggers the vulnerability entirely through their own requests to the service.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or environmental dependencies to satisfy.

Blast Radius

• Crashes or hangs the affected Spring application, making it unable to serve legitimate traffic.
• Sustained request floods can keep the service down indefinitely, causing a full availability outage for dependent systems.
• No confidentiality or data-integrity impact is indicated; the attacker gains no read or write access to application data.