CVE-2017-8046

Critical · CVSS 9.8

spring-data-rest-core — JSON deserialization RCE via malicious PATCH request

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-20

Description

Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

Search profile — drives PoC discovery

Symbols spring-data-rest-corePatchOperationSpelExpressionJsonPatchPatchConverterDomainObjectReaderorg.springframework.data.restPATCHSpEL injection

Keywords CVE-2017-8046Spring Data RESTPATCH RCESpring Boot deserializationSpEL injectionspring-data-rest exploitIngalls SR9Kay SR1arbitrary code execution PATCHspring-data-rest-core PoC

Versions: spring-data-rest-core < 2.6.9 (Ingalls SR9), < 3.0.1 (Kay SR1); Spring Boot < 1.5.9, < 2.0 M6

Ranked PoCs (43) — best first

Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.

cyberharsh/spring8046 candidate

containerized

trickest

★ 0
holisticon/hack-yourself candidate

containerized

trickest

★ 0
FixYourFace/SpringBreakPoC needs review

recent activity

gh_search · Ruby

★ 1
m3ssap0/spring-break_cve-2017-8046 needs review

recent activity

gh_search · Java

★ 17
m3ssap0/SpringBreakVulnerableApp needs review

gh_search · Java

★ 14
Soontao/CVE-2017-8046-DEMO needs review

recent activity

gh_search · Shell

★ 2
jkutner/spring-break-cve-2017-8046 needs review

gh_search · Java

★ 1
sj/spring-data-rest-CVE-2017-8046 needs review

recent activity

gh_search · Java

★ 1
Agilevatester/SpringSecurity needs review

trickest

★ 0
Agilevatester/SpringSecurityV1 needs review

trickest

★ 0
CLincat/vulcat needs review

trickest

★ 0
Emmanuel-Evenzur/Vulnerable_app needs review

trickest

★ 0
Ljw1114/SpringFramework-Vul needs review

trickest

★ 0
NorthShad0w/FINAL needs review

trickest

★ 0
PonusJang/JAVA_WEB_APPLICATION_COLLECTION needs review

trickest

★ 0
Sathyasri1/spring-break needs review

trickest

★ 0
SecureSkyTechnology/study-struts2-s2-054_055-jackson-cve-2017-7525_cve-2017-15095 needs review

trickest

★ 0
Secxt/FINAL needs review

trickest

★ 0
SexyBeast233/SecBooks needs review

trickest

★ 0
Tim1995/FINAL needs review

trickest

★ 0
TrojanAZhen/Self_Back needs review

trickest

★ 0
aaronm-sysdig/report-download needs review

trickest

★ 0
anquanscan/sec-tools needs review

trickest

★ 0
ax1sX/Automation-in-Java-Security needs review

trickest

★ 0
ax1sX/Codeql-In-Java-Security needs review

trickest

★ 0
ax1sX/SpringSecurity needs review

trickest

★ 0
bkhablenko/CVE-2017-8046 needs review

gh_search · Java

★ 0
cyb3r-w0lf/nuclei-template-collection needs review

trickest

★ 0
guanjivip/CVE-2017-8046 needs review

recent activity

gh_search · C++

★ 0
hxysaury/saury-vulnhub needs review

trickest

★ 0
ilmari666/cybsec needs review

trickest

★ 0
jsotiro/VulnerableSpringDataRest needs review

recent activity

gh_search · Java

★ 0
just0rg/Security-Interview needs review

trickest

★ 0
lnick2023/nicenice needs review

trickest

★ 0
nBp1Ng/FrameworkAndComponentVulnerabilities needs review

trickest

★ 0
nBp1Ng/SpringFramework-Vul needs review

trickest

★ 0
nihaohello/N-MiddlewareScan needs review

trickest

★ 0
okostine-panw/pc_scripts needs review

trickest

★ 0
q99266/saury-vulnhub needs review

trickest

★ 0
superfish9/pt needs review

trickest

★ 0
swarna1010/spring-break_cve needs review

trickest

★ 0
tindoc/spring-blog needs review

trickest

★ 0
zisigui123123s/FINAL needs review

trickest

★ 0

Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.

Affected packages

Maven	org.springframework.data:spring-data-rest-core	0 → 2.6.9.RELEASE
Maven	org.springframework.data:spring-data-rest-core	3.0.0 → 3.0.1.RELEASE

References

Status: enriched · ingested 2026-06-27T00:00:38.000Z · profiled 2026-06-30T18:10:12.581Z