{"id":"CVE-2017-8046","aliases":["EUVD-2022-3430","GHSA-9qf9-28h9-hqcj"],"status":"published","title":"Remote code execution in PATCH requests in Spring Data REST","description":"Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.7453,"percentile":0.995,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2018-01-04T06:00:00Z","modified":"2026-10-24T10:30:59Z","exploits":[{"source":"exploitdb","id":"EDB-44289","title":"Spring Data REST \u003c 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution","type":"webapps","platform":"java","date":"2018-03-15","url":"https://www.exploit-db.com/exploits/44289"},{"source":"nuclei","id":"CVE-2017-8046","title":"Spring Data REST \u003c 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-8046.yaml"},{"source":"pocgithub","id":"FixYourFace/SpringBreakPoC","title":"FixYourFace/SpringBreakPoC","date":"2018-03-12","url":"https://github.com/FixYourFace/SpringBreakPoC"},{"source":"pocgithub","id":"bkhablenko/CVE-2017-8046","title":"bkhablenko/CVE-2017-8046","date":"2018-09-26","url":"https://github.com/bkhablenko/CVE-2017-8046"},{"source":"pocgithub","id":"cved-sources/cve-2017-8046","title":"cved-sources/cve-2017-8046","date":"2019-01-17","url":"https://github.com/cved-sources/cve-2017-8046"},{"source":"pocgithub","id":"guanjivip/CVE-2017-8046","title":"guanjivip/CVE-2017-8046","date":"2020-08-01","url":"https://github.com/guanjivip/CVE-2017-8046"},{"source":"pocgithub","id":"jkutner/spring-break-cve-2017-8046","title":"jkutner/spring-break-cve-2017-8046","date":"2018-04-16","url":"https://github.com/jkutner/spring-break-cve-2017-8046"},{"source":"pocgithub","id":"jsotiro/VulnerableSpringDataRest","title":"jsotiro/VulnerableSpringDataRest","date":"2019-04-27","url":"https://github.com/jsotiro/VulnerableSpringDataRest"},{"source":"pocgithub","id":"lgtm-migrator/CVE-2017-8046-DEMO","title":"lgtm-migrator/CVE-2017-8046-DEMO","date":"2022-11-10","url":"https://github.com/lgtm-migrator/CVE-2017-8046-DEMO"},{"source":"pocgithub","id":"m3ssap0/SpringBreakVulnerableApp","title":"m3ssap0/SpringBreakVulnerableApp","date":"2018-03-08","url":"https://github.com/m3ssap0/SpringBreakVulnerableApp"},{"source":"pocgithub","id":"m3ssap0/spring-break_cve-2017-8046","title":"m3ssap0/spring-break_cve-2017-8046","date":"2018-03-09","url":"https://github.com/m3ssap0/spring-break_cve-2017-8046"},{"source":"pocgithub","id":"sj/spring-data-rest-CVE-2017-8046","title":"sj/spring-data-rest-CVE-2017-8046","date":"2017-11-08","url":"https://github.com/sj/spring-data-rest-CVE-2017-8046"}],"fixes":[{"ecosystem":"Maven","package":"org.springframework.data:spring-data-rest-core","fixed_in":["2.6.9.RELEASE","3.0.1.RELEASE"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.9.RELEASE"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.1.RELEASE"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.9.RELEASE"}]}],"versions":["1.0.0.RELEASE","2.0.0.RELEASE","2.0.1.RELEASE","2.0.2.RELEASE","2.0.3.RELEASE","2.1.0.RELEASE","2.1.1.RELEASE","2.1.2.RELEASE","2.1.4.RELEASE","2.1.5.RELEASE","2.1.6.RELEASE","2.2.0.RELEASE","2.2.1.RELEASE","2.2.2.RELEASE","2.2.3.RELEASE","2.2.4.RELEASE","2.3.0.RELEASE","2.3.1.RELEASE","2.3.2.RELEASE","2.4.0.RELEASE","2.4.1.RELEASE","2.4.2.RELEASE","2.4.4.RELEASE","2.4.5.RELEASE","2.4.6.RELEASE","2.5.0.RELEASE","2.5.1.RELEASE","2.5.10.RELEASE","2.5.11.RELEASE","2.5.2.RELEASE","2.5.3.RELEASE","2.5.4.RELEASE","2.5.5.RELEASE","2.5.6.RELEASE","2.5.7.RELEASE","2.5.8.RELEASE","2.5.9.RELEASE","2.6.0.RELEASE","2.6.1.RELEASE","2.6.2.RELEASE","2.6.3.RELEASE","2.6.4.RELEASE","2.6.5.RELEASE","2.6.6.RELEASE","2.6.7.RELEASE","2.6.8.RELEASE"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.data:spring-data-rest-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.1.RELEASE"}]}],"versions":["3.0.0.RELEASE"]}],"products":[{"vendor":"pivotal","product":"pivotal spring data rest and spring boot"},{"vendor":"pivotal_software","product":"spring_data_rest"},{"vendor":"vmware","product":"spring_boot"},{"vendor":"vmware","product":"spring_data_rest"}],"references":[{"url":"https://pivotal.io/security/cve-2017-8046","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2405","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://www.securityfocus.com/bid/100948","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.exploit-db.com/exploits/44289/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8046","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-data-rest/issues/1487","tags":["web"]},{"url":"https://github.com/spring-projects/spring-data-rest/issues/1520","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1553024","tags":["web"]},{"url":"https://jira.spring.io/browse/DATAREST-1127?redirect=false","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9qf9-28h9-hqcj"},{"url":"https://github.com/spring-projects/spring-data-rest","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-8046","description":"Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.","status":"published","published":"2018-01-04T06:00:00Z","modified":"2024-08-05T16:19:29.628Z","updated_at":"2026-11-02T14:33:14.89365Z"}],"euvd":[{"id":"EUVD-2022-3430","description":"Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.","status":"published","published":"2018-01-04T06:00:00Z","modified":"2024-08-05T16:19:29Z","updated_at":"2026-11-03T02:39:06.470138Z"}],"ghsa":[{"id":"GHSA-9qf9-28h9-hqcj","title":"Remote code execution in PATCH requests in Spring Data REST","description":"Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) can use specially crafted JSON data to run arbitrary Java code.","status":"published","published":"2022-05-13T01:02:43Z","modified":"2023-02-02T05:01:22Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:39.76883Z"}],"nvd":[{"id":"CVE-2017-8046","description":"Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.","status":"published","published":"2018-01-04T06:29:00.307Z","modified":"2026-06-26T18:44:14.703Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:12.690425Z"}],"osv":[{"id":"CVE-2017-8046","description":"Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.","status":"published","published":"2018-01-04T06:29:00.307Z","modified":"2026-10-24T10:30:59.26219464Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"GHSA-9qf9-28h9-hqcj","title":"Remote code execution in PATCH requests in Spring Data REST","description":"Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) can use specially crafted JSON data to run arbitrary Java code.","status":"published","published":"2022-05-13T01:02:43Z","modified":"2023-11-08T03:59:27.559276Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}