An attacker can send many distinct requests that trigger failures, filling the application‑wide, stateful retry cache. When the cache reaches capacity it irrevocably rejects further updates, causing all subsequent stateful retries and dependent circuit breakers to fail. As a result the application experiences denial of service, affecting reliability and availability of the affected services.

The vulnerability affects Spring Retry 2.0.0 through 2.0.12 and 1.3.0 through 1.3.4. These versions are part of the Spring framework used by applications that implement stateful retry logic.

The CVSS score of 5.9 indicates a moderate severity, and the EPSS score is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, but it can be exploited remotely by an attacker who can send crafted requests to any endpoint that activates stateful retries. Because the cache is application‑wide, a single attacker can throttle the entire application, making this a universal denial‑of‑service attack for systems using these Spring Retry versions.