CVE-2026-41708

Published Jun 15, 2026

Last updated 4 months ago

CVSS high 7.5
Cloud

Overview

Description
In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled. Affected versions: Spring Cloud Sleuth 3.1.0 through 3.1.13.
Source
security@vmware.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.5
Impact score
3.6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity
HIGH

Weaknesses

security@vmware.com
CWE-400

Social media

Hype score
Not currently trending

Related CVEs

  1. Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in proxy.php when the CODE server isn't running (e.g., the product was recently restarted). The vulnerability is not present in standalone Collabora Online servers; only this deployment with CODE Server is affected.•CVE-2026-110447
  2. Ahsay AhsayCBS Improper Authentication Vulnerability•CVE-2026-105133
  3. Ahsay AhsayCBS Command Injection Vulnerability•CVE-2026-105134
  4. Citrix NetScaler Improper Input Validation Vulnerability•CVE-2026-88771
  5. Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability•CVE-2026-88772

References

Sources include official advisories and independent security research.