Skip to content

CVE-2026-41710

Cache Exhaustion in Stateful Retries leads to Denial of Service

5.9 MediumPublic exploitFix available

An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.

Affected versions: Spring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.28%Up 0.2 points since Jun 9, 2026

What each source reports

CVE List Score used 5.9

Cache Exhaustion in Stateful Retries leads to Denial of Service

An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.

Affected versions: Spring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4.

Record: CVE-2026-41710
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

EUVDEUVD-2026-35321 5.9

An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.

Affected versions: Spring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4.

Record: EUVD-2026-35321
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-2827-2mxx-j8pv 5.9

Spring Retry has Cache Exhaustion in Stateful Retries that leads to Denial of Service

An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.

Affected versions: Spring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4.

Record: GHSA-2827-2mxx-j8pv
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

NVD 5.9

An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.

Affected versions: Spring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4.

Record: CVE-2026-41710
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

OSV 5.9

Cache Exhaustion in Stateful Retries leads to Denial of Service

An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.

Affected versions: Spring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4.

Record: CVE-2026-41710
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

OSVGHSA-2827-2mxx-j8pv 5.9

Spring Retry has Cache Exhaustion in Stateful Retries that leads to Denial of Service

An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.

Affected versions: Spring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4.

Record: GHSA-2827-2mxx-j8pv
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

Show 14 moreShow less

OSVCLSA-2026-1786520698 No score

TuxCare security update for org.springframework.retry:spring-retry (1 CVE)

TuxCare rebuilt org.springframework.retry:spring-retry to address 1 CVE. Fixed in 1.3.4-tuxcare.1.

Record: CLSA-2026-1786520698
Updated: 2026-11-02

OSVCLSA-2026-1791318628 No score

TuxCare security update for org.springframework.retry:spring-retry (1 CVE)

TuxCare rebuilt org.springframework.retry:spring-retry to address 1 CVE. Fixed in 2.0.11-tuxcare.1.

Record: CLSA-2026-1791318628
Updated: 2026-11-02

OSVCLSA-2026-1791320662 No score

TuxCare security update for org.springframework.retry:spring-retry (1 CVE)

TuxCare rebuilt org.springframework.retry:spring-retry to address 1 CVE. Fixed in 2.0.12-tuxcare.1.

Record: CLSA-2026-1791320662
Updated: 2026-11-02

OSVCLSA-2026-1791455309 No score

TuxCare security update for org.springframework.retry:spring-retry (1 CVE)

TuxCare rebuilt org.springframework.retry:spring-retry to address 1 CVE. Fixed in 2.0.10-tuxcare.1.

Record: CLSA-2026-1791455309
Updated: 2026-11-02

OSVCLSA-2026-1791960902 No score

TuxCare security update for org.springframework.retry:spring-retry (1 CVE)

TuxCare rebuilt org.springframework.retry:spring-retry to address 1 CVE. Fixed in 1.2.1.RELEASE-tuxcare.1.

Record: CLSA-2026-1791960902
Updated: 2026-11-02

OSVCLSA-2026-1792010798 No score

TuxCare security update for org.springframework.retry:spring-retry (1 CVE)

TuxCare rebuilt org.springframework.retry:spring-retry to address 1 CVE. Fixed in 1.0.2.RELEASE-tuxcare.2.

Record: CLSA-2026-1792010798
Updated: 2026-11-02

OSVCLSA-2026-1792595488 No score

TuxCare security update for org.springframework.retry:spring-retry (1 CVE)

TuxCare rebuilt org.springframework.retry:spring-retry to address 1 CVE. Fixed in 1.3.1-tuxcare.1.

Record: CLSA-2026-1792595488
Updated: 2026-11-02

OSVCLSA-2026-1792596227 No score

TuxCare security update for org.springframework.retry:spring-retry (1 CVE)

TuxCare rebuilt org.springframework.retry:spring-retry to address 1 CVE. Fixed in 1.3.3-tuxcare.1.

Record: CLSA-2026-1792596227
Updated: 2026-11-02

OSVCLSA-2026-1792596234 No score

TuxCare security update for org.springframework.retry:spring-retry (1 CVE)

TuxCare rebuilt org.springframework.retry:spring-retry to address 1 CVE. Fixed in 1.2.5.RELEASE-tuxcare.1.

Record: CLSA-2026-1792596234
Updated: 2026-11-02

OSVCLSA-2026-1792596296 No score

TuxCare security update for org.springframework.retry:spring-retry (1 CVE)

TuxCare rebuilt org.springframework.retry:spring-retry to address 1 CVE. Fixed in 2.0.6-tuxcare.1.

Record: CLSA-2026-1792596296
Updated: 2026-11-02

OSVCLSA-2026-1792596369 No score

TuxCare security update for org.springframework.retry:spring-retry (1 CVE)

TuxCare rebuilt org.springframework.retry:spring-retry to address 1 CVE. Fixed in 2.0.4-tuxcare.1.

Record: CLSA-2026-1792596369
Updated: 2026-11-02

OSVCLSA-2026-1792596458 No score

TuxCare security update for org.springframework.retry:spring-retry (1 CVE)

TuxCare rebuilt org.springframework.retry:spring-retry to address 1 CVE. Fixed in 1.2.2.RELEASE-tuxcare.1.

Record: CLSA-2026-1792596458
Updated: 2026-11-02

OSVCLSA-2026-1792596683 No score

TuxCare security update for org.springframework.retry:spring-retry (1 CVE)

TuxCare rebuilt org.springframework.retry:spring-retry to address 1 CVE. Fixed in 1.1.5.RELEASE-tuxcare.1.

Record: CLSA-2026-1792596683
Updated: 2026-11-02

OSVCLSA-2026-1792596994 No score

TuxCare security update for org.springframework.retry:spring-retry (1 CVE)

TuxCare rebuilt org.springframework.retry:spring-retry to address 1 CVE. Fixed in 1.2.4.RELEASE-tuxcare.1.

Record: CLSA-2026-1792596994
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.springframework.retry:spring-retry` Maven	2.0.0 to 2.0.12	2.0.13
`org.springframework.retry:spring-retry` Maven	through 1.3.4	None known
`org.springframework.retry:spring-retry` TuxCare:Maven	1.3.4 up to 1.3.4-tuxcare.1, plus listed versions 1.3.4.tuxcare	1.3.4-tuxcare.1
`org.springframework.retry:spring-retry` TuxCare:Maven	2.0.11 up to 2.0.11-tuxcare.1	2.0.11-tuxcare.1
`org.springframework.retry:spring-retry` TuxCare:Maven	2.0.12 up to 2.0.12-tuxcare.1	2.0.12-tuxcare.1
`org.springframework.retry:spring-retry` TuxCare:Maven	2.0.10 up to 2.0.10-tuxcare.1	2.0.10-tuxcare.1
`org.springframework.retry:spring-retry` TuxCare:Maven	1.2.1.RELEASE up to 1.2.1.RELEASE-tuxcare.1	1.2.1.RELEASE-tuxcare.1
`org.springframework.retry:spring-retry` TuxCare:Maven	1.0.2.RELEASE up to 1.0.2.RELEASE-tuxcare.2, plus listed versions 1.0.2.RELEASE-tuxcare.1	1.0.2.RELEASE-tuxcare.2
`org.springframework.retry:spring-retry` TuxCare:Maven	1.3.1 up to 1.3.1-tuxcare.1	1.3.1-tuxcare.1
`org.springframework.retry:spring-retry` TuxCare:Maven	1.3.3 up to 1.3.3-tuxcare.1	1.3.3-tuxcare.1

Show 8 moreShow less

Affected packages
Package	Affected	Fixed
`org.springframework.retry:spring-retry` TuxCare:Maven	1.2.5.RELEASE up to 1.2.5.RELEASE-tuxcare.1	1.2.5.RELEASE-tuxcare.1
`org.springframework.retry:spring-retry` TuxCare:Maven	2.0.6 up to 2.0.6-tuxcare.1	2.0.6-tuxcare.1
`org.springframework.retry:spring-retry` TuxCare:Maven	2.0.4 up to 2.0.4-tuxcare.1	2.0.4-tuxcare.1
`org.springframework.retry:spring-retry` TuxCare:Maven	1.2.2.RELEASE up to 1.2.2.RELEASE-tuxcare.1	1.2.2.RELEASE-tuxcare.1
`org.springframework.retry:spring-retry` TuxCare:Maven	1.1.5.RELEASE up to 1.1.5.RELEASE-tuxcare.1	1.1.5.RELEASE-tuxcare.1
`org.springframework.retry:spring-retry` TuxCare:Maven	1.2.4.RELEASE up to 1.2.4.RELEASE-tuxcare.1	1.2.4.RELEASE-tuxcare.1
`org.springframework.retry:spring-retry` Maven	2.0.0 up to 2.0.13, plus listed versions 2.0.12.0.102.0.112.0.122.0.2 Show 7 moreShow less 2.0.32.0.42.0.52.0.62.0.72.0.82.0.9	2.0.13
`org.springframework.retry:spring-retry` Maven	through 1.3.4, plus listed versions 1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.0.3.RELEASE1.1.0.RELEASE Show 15 moreShow less 1.1.1.RELEASE1.1.2.RELEASE1.1.3.RELEASE1.1.4.RELEASE1.1.5.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.2.3.RELEASE1.2.4.RELEASE1.2.5.RELEASE1.3.01.3.11.3.21.3.3	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	NicheToolkit/spring-retry-toolkit	2026-08-10

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41710 is a medium vulnerability (CVSS 5.9) in Broadcom Spring Retry, published June 9, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in org.springframework.retry:spring-retry 2.0.13.

References