Description
In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled.
Affected versions:
Spring Cloud Sleuth 3.1.0 through 3.1.13.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring | Spring Cloud Sleuth | 3.1.0 – < 3.1.14 | 3.1.14 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-sleuth-instrumentation | >= 3.1.0, <= 3.1.11 | — | GHSA-26m2-9g2q-v45q |
Advisories 1
- WID-SEC-2026-1901 VMware Tanzu Spring Cloud Gateway Server und Sleuth: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 15, 2026