Critical
Security advisory
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-8046
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:50 UTC · Revision 1
Source evidence
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
osv:CVE-2017-8046
Complete source record
{
"id": "4f59823047012a26dcfc5b08c77824909e67f090dbda330522a1cbd9e3381ea5",
"url": "https://osv.dev/vulnerability/CVE-2017-8046",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-8046",
"summary": "Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.",
"evidence": "osv:CVE-2017-8046",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2017-8046",
"aliases": [
"CVE-2017-8046",
"GHSA-9qf9-28h9-hqcj"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/spring-projects/spring-boot",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "1e8b9569d3a3900a0ed61712099823ad735b8078"
},
{
"introduced": "a9503abb94b203a717527b81a94dc9d3cb4b1afa"
},
{
"last_affected": "1c02e9e1eafa19ff7753d56105ed1f6fad5d2b9d"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.5.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vmware:spring_boot:2.0.0:milestone1:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0-milestone1"
},
{
"last_affected": "2.0.0-milestone1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vmware:spring_boot:2.0.0:milestone2:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0-milestone2"
},
{
"last_affected": "2.0.0-milestone2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vmware:spring_boot:2.0.0:milestone3:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0-milestone3"
},
{
"last_affected": "2.0.0-milestone3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vmware:spring_boot:2.0.0:milestone4:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0-milestone4"
},
{
"last_affected": "2.0.0-milestone4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vmware:spring_boot:2.0.0:milestone5:*:*:*:*:*:*",
"range": [
{
"introduced": "2.0.0-milestone5"
},
{
"last_affected": "2.0.0-milestone5"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"2.0.0-milestone1",
"2.0.0-milestone2",
"2.0.0-milestone3",
"2.0.0-milestone4",
"2.0.0-milestone5",
"v2.0.0.M5",
"v1.0.0.RC4",
"v1.0.0.RC3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8046.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/spring-projects/spring-data-rest",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "6f83d86552ff676d48100e10b327d759c0fa44fd"
},
{
"introduced": "e54f90821877d36d2eea37dea1255b223eae647f"
},
{
"last_affected": "c3dc9ebfaf232b6295e2bad5f40c306d7b21ba8a"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:vmware:spring_data_rest:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.6.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-rc1"
},
{
"last_affected": "3.0.0-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc2:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-rc2"
},
{
"last_affected": "3.0.0-rc2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:vmware:spring_data_rest:3.0.0:rc3:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0.0-rc3"
},
{
"last_affected": "3.0.0-rc3"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"3.0.0-rc1",
"3.0.0-rc2",
"3.0.0-rc3",
"2.6.8.RELEASE",
"3.0.0.RC3",
"2.6.7.RELEASE",
"2.6.6.RELEASE",
"3.0.0.RC2",
"3.0.0.RC1",
"2.6.5.RELEASE",
"2.6.4.RELEASE",
"2.6.3.RELEASE",
"2.6.2.RELEASE",
"2.6.1.RELEASE",
"2.6.0.RELEASE",
"2.6.0.RC1",
"2.6.0.M1",
"2.5.0.RELEASE",
"2.5.0.RC1",
"2.5.0.M1",
"2.4.0.RELEASE",
"2.4.0.RC1",
"2.4.0.M1",
"2.3.0.RELEASE",
"2.3.0.RC1",
"2.3.0.M1",
"2.2.0.RELEASE",
"2.2.0.RC1",
"2.2.0.M1",
"2.1.0.RELEASE",
"2.1.0.RC1",
"2.1.0.M1",
"2.0.0.RELEASE",
"2.0.0.RC1",
"2.0.0.M1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8046.json"
}
}
],
"modified": "2026-10-24T10:30:59.262194640Z",
"provider": "osv",
"references": [
"https://access.redhat.com/errata/RHSA-2018:2405",
"https://pivotal.io/security/cve-2017-8046",
"https://www.exploit-db.com/exploits/44289/"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m1:*:*:*:*:*:*",
"cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m2:*:*:*:*:*:*",
"cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m3:*:*:*:*:*:*",
"cpe:2.3:a:pivotal_software:spring_data_rest:3.0.0:m4:*:*:*:*:*:*"
],
"vendor_product": "pivotal_software:spring_data_rest",
"extracted_events": [
{
"range": [
{
"introduced": "3.0.0"
},
{
"last_affected": "3.0.0"
},
{
"introduced": "3.0.0-m1"
},
{
"last_affected": "3.0.0-m1"
},
{
"introduced": "3.0.0-m2"
},
{
"last_affected": "3.0.0-m2"
},
{
"introduced": "3.0.0-m3"
},
{
"last_affected": "3.0.0-m3"
},
{
"introduced": "3.0.0-m4"
},
{
"last_affected": "3.0.0-m4"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2017-8046",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 439271,
"published_at": "2018-01-04T06:29:00.307+00:00"
}