{"id":"CVE-2026-41710","title":"An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache","summary":"An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later s…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-770"],"vendor":"broadcom","product":"spring_retry","affected":["spring_retry < 1.3.5","spring_retry >= 2.0.0, < 2.0.12.1"],"patched":["spring_retry 2.0.12.1"],"published":"2026-06-09","updated":"2026-09-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41710","references":[{"url":"https://spring.io/security/cve-2026-41710","label":"security@vmware.com"}],"tags":["nvd","exploit-available"],"epss":0.0028,"epssPercentile":0.20747,"ingestedAt":"2026-09-05T13:39:54.539Z","exploits":{"github":1,"githubRepos":["https://github.com/NicheToolkit/spring-retry-toolkit"],"checkedAt":"2026-09-23T07:14:04.316Z"},"exploitAvailable":true,"slug":"CVE-2026-41710","body":"## Overview\n\nAn attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.\n\nAffected versions:\nSpring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4.\n\n## Affected\n\n- `spring_retry < 1.3.5`\n- `spring_retry >= 2.0.0, < 2.0.12.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `spring_retry 2.0.12.1`","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":5187,"id":"CVE-2026-41710","ts":1788887252298,"field":"exploit_available","old":"false","new":"true"},{"seq":4070,"id":"CVE-2026-41710","ts":1788886368300,"field":"exploit_available","old":"true","new":"false"},{"seq":2859,"id":"CVE-2026-41710","ts":1788883034832,"field":"exploit_available","old":"false","new":"true"},{"seq":1888,"id":"CVE-2026-41710","ts":1788882437771,"field":"exploit_available","old":"true","new":"false"},{"seq":985,"id":"CVE-2026-41710","ts":1788881872339,"field":"exploit_available","old":"false","new":"true"}]}