Pivotal Spring Data REST and Spring Boot - RCE (CVE-2017-8046)
Description
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
psychologyCrowdSec Analysis
CVE-2017-8046 is a critical vulnerability in Pivotal Spring Data REST and Spring Boot that allows remote attackers to execute arbitrary Java code by sending maliciously crafted PATCH requests with JSON payloads. This flaw can be exploited without authentication, potentially leading to full system compromise, data theft, or service disruption.
CrowdSec has been tracking this vulnerability and its exploits since 10th of September 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2017-8046 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit this vulnerability by sending malicious PATCH requests with crafted JSON payloads to Spring Data REST endpoints, often targeting URLs discovered via HAL links in API responses. The exploit leverages the application/json-patch+json content type and attempts to execute arbitrary Java code on the server.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2018-01-04 |
| Rule Released | 2025-09-10 |
| CrowdSec First Seen | 2025-09-11 |