CVE-2017-8046: Spring Data REST PATCH requests allow remote Java code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 3.0 base score is 9.8 with network reachability, no privileges and no user interaction, and public exploit code plus very high EPSS probability make exploitation likely.

What it is

Spring Data REST before 2.6.9 (Ingalls SR9) and before 3.0.1 (Kay SR1), and Spring Boot before 1.5.9 and 2.0 M6, fail to properly validate specially crafted JSON submitted in PATCH requests. An unauthenticated remote attacker can exploit this improper input validation to execute arbitrary Java code on the server.

Impact

Successful exploitation gives the attacker arbitrary Java code execution in the context of the affected application, leading to full compromise of confidentiality, integrity and availability of the host.

Attack surface

The flaw is reached over the network through HTTP PATCH requests to Spring Data REST endpoints, requiring no authentication and no user interaction per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

CVE-2017-8046 is not listed in CISA KEV, but EPSS gives a 30-day exploitation probability of 0.7453 (99.5th percentile) and a public Exploit-DB entry (44289) exists, indicating mature public exploit code.

What to do

• Upgrade Spring Data REST to 2.6.9 (Ingalls SR9) or 3.0.1 (Kay SR1) and Spring Boot to 1.5.9 or later as applicable.
• Apply the vendor errata (e.g. Red Hat RHSA-2018:2405) for packaged distributions.
• Restrict or disable unauthenticated PATCH access to Spring Data REST endpoints at the network or gateway layer until patched.
• Add authentication and authorization in front of Spring Data REST endpoints so PATCH requests are not anonymously reachable.

Detection

• Inspect HTTP logs for PATCH requests to Spring Data REST endpoints, especially with JSON bodies containing unusual or nested property paths.
• Alert on PATCH requests returning 200/204 from Spring Data REST paths originating from unexpected source IPs.
• Monitor application and JVM logs for unexpected class loading, deserialization errors or command execution following PATCH traffic.
• Correlate outbound network connections or child processes spawned by the Java application process after PATCH requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.