CVE-2017-8046
Remote code execution in PATCH requests in Spring Data REST
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
- Record
CVE-2017-8046- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
- Record
CVE-2017-8046- Updated
- 2026-11-02
EUVDEUVD-2022-3430 No score
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
- Record
EUVD-2022-3430- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9qf9-28h9-hqcj
Remote code execution in PATCH requests in Spring Data REST
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) can use specially crafted JSON data to run arbitrary Java code.
- Record
GHSA-9qf9-28h9-hqcj- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
- Record
CVE-2017-8046- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-9qf9-28h9-hqcj
Remote code execution in PATCH requests in Spring Data REST
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) can use specially crafted JSON data to run arbitrary Java code.
- Record
GHSA-9qf9-28h9-hqcj- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-rest-coreMaven |
before 2.6.9.RELEASE | 2.6.9.RELEASE |
org.springframework.data:spring-data-rest-coreMaven |
3.0.0 up to 3.0.1.RELEASE | 3.0.1.RELEASE |
org.springframework.data:spring-data-rest-coreMaven |
before 2.6.9.RELEASE, plus listed versions 1.0.0.RELEASE2.0.0.RELEASE2.0.1.RELEASE2.0.2.RELEASE2.0.3.RELEASE Show 41 moreShow less2.1.0.RELEASE2.1.1.RELEASE2.1.2.RELEASE2.1.4.RELEASE2.1.5.RELEASE2.1.6.RELEASE2.2.0.RELEASE2.2.1.RELEASE2.2.2.RELEASE2.2.3.RELEASE2.2.4.RELEASE2.3.0.RELEASE2.3.1.RELEASE2.3.2.RELEASE2.4.0.RELEASE2.4.1.RELEASE2.4.2.RELEASE2.4.4.RELEASE2.4.5.RELEASE2.4.6.RELEASE2.5.0.RELEASE2.5.1.RELEASE2.5.10.RELEASE2.5.11.RELEASE2.5.2.RELEASE2.5.3.RELEASE2.5.4.RELEASE2.5.5.RELEASE2.5.6.RELEASE2.5.7.RELEASE2.5.8.RELEASE2.5.9.RELEASE2.6.0.RELEASE2.6.1.RELEASE2.6.2.RELEASE2.6.3.RELEASE2.6.4.RELEASE2.6.5.RELEASE2.6.6.RELEASE2.6.7.RELEASE2.6.8.RELEASE |
2.6.9.RELEASE |
org.springframework.data:spring-data-rest-coreMaven |
3.0.0 up to 3.0.1.RELEASE, plus listed versions 3.0.0.RELEASE |
3.0.1.RELEASE |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution | 2018-03-15 |
| Nuclei | Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution | |
| PoC in GitHub | FixYourFace/SpringBreakPoC | 2018-03-12 |
| PoC in GitHub | bkhablenko/CVE-2017-8046 | 2018-09-26 |
| PoC in GitHub | cved-sources/cve-2017-8046 | 2019-01-17 |
| PoC in GitHub | guanjivip/CVE-2017-8046 | 2020-08-01 |
| PoC in GitHub | jkutner/spring-break-cve-2017-8046 | 2018-04-16 |
| PoC in GitHub | jsotiro/VulnerableSpringDataRest | 2019-04-27 |
| PoC in GitHub | lgtm-migrator/CVE-2017-8046-DEMO | 2022-11-10 |
| PoC in GitHub | m3ssap0/SpringBreakVulnerableApp | 2018-03-08 |
| PoC in GitHub | m3ssap0/spring-break_cve-2017-8046 | 2018-03-09 |
| PoC in GitHub | sj/spring-data-rest-CVE-2017-8046 | 2017-11-08 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-8046 is a critical vulnerability (CVSS 9.8) in Pivotal Software Spring Data Rest, published January 4, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 74.5%, the 99th percentile. Fixed in org.springframework.data:spring-data-rest-core 2.6.9.RELEASE.