This vulnerability (CWE-770) in Spring Retry allows an attacker to exhaust the capacity of the stateful retry cache by crafting a large number of unique failure-triggering requests. The cache, once full, stops accepting updates, which disables all later stateful retries and circuit breakers in the application. Affected versions include Spring Retry 1.3.0 through 1.3.4 and 2.0.0 through 2.0.12. The CVSS 3.1 base score is 5.9 (medium severity), reflecting a network attack vector with high attack complexity and no privileges or user interaction required. There is no indication of confidentiality or integrity impact, only availability is affected.

The vulnerability causes a denial of service condition by exhausting the retry cache, leading to permanent failure of stateful retries and circuit breakers in the affected application. This impacts application availability but does not affect confidentiality or integrity. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external rate limiting or request throttling to reduce the risk of cache exhaustion. Monitor application behavior for signs of retry cache saturation. Avoid relying solely on stateful retries and circuit breakers in affected versions.