---
id: CVE-2026-41710
title: >-
  An attacker can craft a large number of unique requests that trigger a
  failure, exhausting the capacity of the application-wide stateful retry cache
summary: >-
  An attacker can craft a large number of unique requests that trigger a
  failure, exhausting the capacity of the application-wide stateful retry cache.
  Once the cache is full, it permanently rejects any further updates, causing
  all later s…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
vendor: broadcom
product: spring_retry
affected:
  - spring_retry < 1.3.5
  - 'spring_retry >= 2.0.0, < 2.0.12.1'
patched:
  - spring_retry 2.0.12.1
published: '2026-06-09'
updated: '2026-09-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41710'
references:
  - url: 'https://spring.io/security/cve-2026-41710'
    label: security@vmware.com
tags:
  - nvd
  - exploit-available
epss: 0.00367
epssPercentile: 0.27754
ingestedAt: '2026-09-05T13:39:54.539Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/NicheToolkit/spring-retry-toolkit'
  checkedAt: '2026-09-25T08:20:56.809Z'
exploitAvailable: true
---

## Overview

An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.

Affected versions:
Spring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4.

## Affected

- `spring_retry < 1.3.5`
- `spring_retry >= 2.0.0, < 2.0.12.1`

## Remediation

Upgrade past the affected range:

- `spring_retry 2.0.12.1`