---
id: CVE-2017-8046
title: >-
  Malicious PATCH requests submitted to servers using Spring Data REST versions
  prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring
  Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to
  run arbi…
summary: >-
  Malicious PATCH requests submitted to servers using Spring Data REST versions
  prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring
  Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to
  run arbi…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-20
vendor: vmware
product: spring_boot
affected:
  - spring_boot < 1.5.9
  - spring_boot = 2.0.0
  - spring_data_rest = 3.0.0
  - spring_data_rest < 2.6.9
patched:
  - spring_boot 1.5.9
  - spring_data_rest 2.6.9
published: '2018-01-04'
updated: '2026-06-26'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2017-8046'
references:
  - url: 'http://www.securityfocus.com/bid/100948'
    label: security_alert@emc.com
  - url: 'https://access.redhat.com/errata/RHSA-2018:2405'
    label: security_alert@emc.com
  - url: 'https://pivotal.io/security/cve-2017-8046'
    label: security_alert@emc.com
  - url: 'https://www.exploit-db.com/exploits/44289/'
    label: security_alert@emc.com
  - url: 'http://www.securityfocus.com/bid/100948'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/errata/RHSA-2018:2405'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://pivotal.io/security/cve-2017-8046'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.exploit-db.com/exploits/44289/'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - in-the-wild
  - exploit-available
epss: 0.53936
epssPercentile: 0.98978
exploited: true
exploitAvailable: true
ingestedAt: '2026-06-29T13:24:33.211Z'
exploits:
  exploitdb: true
  github: 10
  githubRepos:
    - 'https://github.com/sj/spring-data-rest-CVE-2017-8046'
    - 'https://github.com/m3ssap0/SpringBreakVulnerableApp'
    - 'https://github.com/m3ssap0/spring-break_cve-2017-8046'
  nuclei:
    - CVE-2017-8046
  checkedAt: '2026-09-21T15:23:36.904Z'
---

## Overview

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

## Affected

- `spring_boot < 1.5.9`
- `spring_boot = 2.0.0`
- `spring_data_rest = 3.0.0`
- `spring_data_rest < 2.6.9`

## Remediation

Upgrade past the affected range:

- `spring_boot 1.5.9`
- `spring_data_rest 2.6.9`