Description

An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retry cache. Once the cache is full, it permanently rejects any further updates, causing all later stateful retries and circuit breakers in the application to fail.

This issue only affects applications where all the following are true:

• It explicitly enables stateful retries using @Retryable(stateful=true).
• The cache keys for these stateful retries are attacker-controlled, which is the case with the default key generator if the method arguments are provided by the attacker.
• The attacker can cause the invocation to fail and ensure the same request is never re-presented.

Because cache entries are only removed upon success or retry exhaustion, a failed item that is abandoned stays in the cache forever.

Stateless retries, which are the default behavior, are not vulnerable.

Affected Spring Products and Versions

Spring Retry:

• 2.0.0 - 2.0.12
• 1.3.0 - 1.3.4

Versions that are no longer supported are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

References

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H&version=3.1

History

• 2026-06-08: Initial vulnerability report published.