CVE-2026-41708

Overview

Spring Cloud Sleuth is a distributed tracing library for Spring Boot applications that automatically instruments common components, including the Spring transaction manager, to propagate trace and span context. A high-severity vulnerability (CVE-2026-41708) has been identified in the Spring transaction instrumentation provided by spring-cloud-sleuth-instrumentation. When transaction tracing is enabled, a transaction whose commit fails leaves a stale tracing state in a per-thread data structure that is never released, allowing specially crafted calls to exhaust memory and cause a denial-of-service condition.

Per OWASP, a Denial of Service attack is one in which "the attacker seeks to make a resource unavailable to its intended users." Here, repeated failed transaction commits force unbounded memory growth that exhausts the heap and denies service to legitimate users.

This issue affects versions >=3.1.0 <=3.1.13 of Spring Cloud Sleuth.

‍

Details

Module Info

• Product: Spring Cloud Sleuth
• Affected packages: spring-cloud-sleuth-instrumentation
• Affected versions: >=3.1.0 <=3.1.13
• GitHub repository: https://github.com/spring-cloud/spring-cloud-sleuth
• Published packages: https://central.sonatype.com/artifact/org.springframework.cloud/spring-cloud-sleuth-instrumentation
• Package manager: Maven
• Fixed in:
• NES for Spring Cloud Sleuth 3.1.x

Vulnerability Info

Spring Cloud Sleuth instruments Spring's PlatformTransactionManager with TracePlatformTransactionManager, which wraps a delegate transaction manager and records a tracing span for each transaction. The span and its scope are tracked per thread in a ThreadLocalSpan, which stores entries in a ThreadLocal<ArrayDeque<SpanAndScope>>. Calling set(...) pushes an entry onto the deque, and calling remove() pops it and closes the associated scope.

In the commit(TransactionStatus) method, the thread-local entry is only cleared when the commit succeeds:

Exception ex = null;
Span span = spanAndScope.getSpan();
try {
    this.delegate.commit(status);
}
catch (Exception e) {
    ex = e;
    span.error(e);
    throw e;
}
finally {
    SleuthTxSpan.TX_SPAN.wrap(span).event(SleuthTxSpan.Events.COMMIT);
    spanAndScope.close();
    if (ex == null) {
        this.threadLocalSpan.remove();
    }
}

When delegate.commit(status) throws, for example on a rolled-back or timed-out transaction, the finally block closes the scope but skips this.threadLocalSpan.remove() because an exception was recorded. The entry is therefore never popped from the per-thread ArrayDeque. Each failed commit leaves a stale SpanAndScope on the thread-local stack, and the deque grows without bound. An attacker able to repeatedly drive transactions to fail at commit time can exhaust the heap and trigger an OutOfMemoryError, denying service to legitimate users. The companion rollback(...) path is not affected because it always clears the thread-local entry.

An application is vulnerable when it uses an affected version of spring-cloud-sleuth-instrumentation and Spring transaction instrumentation has not been disabled, which is the default configuration.

This vulnerability was introduced in 2021 with Spring Cloud Sleuth 3.1.

‍

Mitigation

Spring Cloud Sleuth is End-of-Life and its repository has been archived at https://github.com/spring-cloud/spring-cloud-sleuth. Distributed tracing functionality has moved to Micrometer Tracing, and the affected 3.1.x line will not receive further public updates; these versions have no publicly available fix. HeroDevs does not recommend that users attempt to develop and apply their own source patches to End-of-Life software.

The recommended actions are:

1. Upgrade to a supported tracing solution by migrating from Spring Cloud Sleuth to Micrometer Tracing.
2. For applications that must remain on Spring Cloud Sleuth, HeroDevs Never-Ending Support (NES) for Spring Cloud Sleuth is making a fix for this vulnerability available as a drop-in replacement for the affected versions. Learn more about HeroDevs Never-Ending Support for Spring Cloud Sleuth and request coverage at https://www.herodevs.com/support/spring-nes