TI-2026-30226 Aliases CVE-2026-41710 GHSA-2827-2mxx-j8pv

Cache Exhaustion in Stateful Retries leads to Denial of Service

LOW 26CWE-770Published 2026-06-09 · Updated 2026-06-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail. Affected versions: Spring Retry 2.0.0 through 2.0.12; 1.3.0 through 1.3.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0028 20th percentileScored 2026-11-07

Fix Partial Spring Retry (Spring): 2.0.12.1, 1.3.5org.springframework.retry:spring-retry (Maven): 2.0.13Red Hat: 5 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VMware	Spring Retry	2.0.0 to before 2.0.12.1; 1.3.0 to before 1.3.5	2.0.12.1, 1.3.5	Patch available	CNA
—	org.springframework.retry:spring-retry (Maven)	2.0.0 to before 2.0.13	2.0.13	Patch available	GHSA-2827-2mxx-j8pv
—	org.springframework.retry:spring-retry (Maven)	up to 1.3.4	—	No fix listed	GHSA-2827-2mxx-j8pv

Spring Retry VendorVMware Affected 2.0.0 to before 2.0.12.1; 1.3.0 to before 1.3.5 Fixed in 2.0.12.1, 1.3.5 Patch available CNA
org.springframework.retry:spring-retry (Maven) Vendor— Affected 2.0.0 to before 2.0.13 Fixed in 2.0.13 Patch available GHSA-2827-2mxx-j8pv
org.springframework.retry:spring-retry (Maven) Vendor— Affected up to 1.3.4 Fixed in — No fix listed GHSA-2827-2mxx-j8pv

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:broadcom:spring_retry::::::::	before 1.3.5; 2.0.0 to before 2.0.12.1	Vulnerable	Broadcom

cpe:2.3:a:broadcom:spring_retry:*:*:*:*:*:*:*:* Versions before 1.3.5; 2.0.0 to before 2.0.12.1 Vulnerable ·Broadcom

Remediation

Fix · CNA Spring Retry (Spring) Fixed in 2.0.12.1, 1.3.5
Fix · GHSA-2827-2mxx-j8pv org.springframework.retry:spring-retry (Maven) Fixed in 2.0.13 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Data Grid 8	Affected	No fix yet: Fix deferred
Red Hat Fuse 7	Affected	No fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix planned: Out of support scope
Red Hat OpenShift Dev Spaces	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel 4 for Quarkus 3	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-41710
2026-10-03 Alias added: GHSA-2827-2mxx-j8pv

References

Advisory 2

Other 4

TI-2026-42442 vCenter directory-traversal vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2024-26040 Privilege escalation in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2024-26039 Heap-overflow in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2024-24610 Out-of-bounds write in VMware vCenter Server KEVCVSS 3.1CRITICAL 9.8
TI-2023-16914 VMware vCenter Server Out-of-Bounds Write Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2023-07303 Command injection in Aria Operations for Networks KEVCVSS 3.1CRITICAL 9.8

See all 1181 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences