CVE-2017-8046
Critical · 9.8CVSS
9.8
EPSS
74.5%
Published
Jan 4, 2018
CISA due date
—
The record
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.springframework.data:spring-data-rest-core | 0 | 2.6.9.RELEASE |
| Maven | org.springframework.data:spring-data-rest-core | 3.0.0 | 3.0.1.RELEASE |
| maven | org.springframework.data/spring-data-rest-core | 3.0.0-SNAPSHOT | 3.0.1 |
Related vulnerabilities
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-20
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-20
- CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. CWE-20
- CVE-2026-100347 kin-openapi is a Go project for handling OpenAPI files. CWE-20
- CVE-2026-99999 In the Linux kernel, the following vulnerability has been resolved: ipv4: validate… CWE-20
- CVE-2026-107726 Hazelcast is a unified real-time data platform combining stream processing with a fast… CWE-20
- CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-20
- CVE-2026-105756 vLLM is an inference and serving engine for large language models. CWE-20