CVE-2024-22871
Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service
An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.
- Record
CVE-2024-22871- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2024-0741
An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.
- Record
EUVD-2024-0741- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vr64-r9qj-h27f
Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service
Any program on the JVM may read serialized objects via java.io.ObjectInputStream.readObject(). Reading serialized objects from an untrusted source is inherently unsafe (this affects any program running on any version of the JVM) and is a prerequisite for this vulnerability.
Clojure classes that represent infinite seqs (Cycle, infinite Repeat, and Iterate) do not define hashCode() and use the parent ASeq.hashCode(), which walks the seq to compute the hash, yielding an infinite loop. Classes like java.util.HashMap call hashCode() on keys during deserialization of a serialized map.
The exploit requires:
- Crafting a serialized HashMap object with an infinite seq object as a key.
- Sending that to a program that reads serialized objects via ObjectInputStream.readObject().
This will cause the program to enter an infinite loop on the reading thread and thus a denial of service (DoS).
The affected Clojure classes (Cycle, Repeat, Iterate) exist in Clojure 1.7.0-1.11.1, 1.12.0-alpha1-1.12.0-alpha8.
- Record
GHSA-vr64-r9qj-h27f- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.
- Record
CVE-2024-22871- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVALPINE-CVE-2024-22871
An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.
- Record
ALPINE-CVE-2024-22871- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.
- Record
CVE-2024-22871- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2024-22871
An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.
- Record
DEBIAN-CVE-2024-22871- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-vr64-r9qj-h27f
Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service
Any program on the JVM may read serialized objects via java.io.ObjectInputStream.readObject(). Reading serialized objects from an untrusted source is inherently unsafe (this affects any program running on any version of the JVM) and is a prerequisite for this vulnerability.
Clojure classes that represent infinite seqs (Cycle, infinite Repeat, and Iterate) do not define hashCode() and use the parent ASeq.hashCode(), which walks the seq to compute the hash, yielding an infinite loop. Classes like java.util.HashMap call hashCode() on keys during deserialization of a serialized map.
The exploit requires:
- Crafting a serialized HashMap object with an infinite seq object as a key.
- Sending that to a program that reads serialized objects via ObjectInputStream.readObject().
This will cause the program to enter an infinite loop on the reading thread and thus a denial of service (DoS).
The affected Clojure classes (Cycle, Repeat, Iterate) exist in Clojure 1.7.0-1.11.1, 1.12.0-alpha1-1.12.0-alpha8.
- Record
GHSA-vr64-r9qj-h27f- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-22871
An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.
- Record
UBUNTU-CVE-2024-22871- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2024-0093 No score
Updated clojure packages fix security vulnerability
An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function. (CVE-2024-22871)
- Record
MGASA-2024-0093- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13763-1 No score
clojure-1.11.2.1446-1.1 on GA media
These are all security issues fixed in the clojure-1.11.2.1446-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13763-1- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2024-22871 No score
CVE-2024-22871 in io.root.org.clojure:clojure - Patched by Root
Root has patched CVE-2024-22871 in the io.root.org.clojure:clojure package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2024-22871- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.clojure:clojureMaven |
1.7.0 up to 1.11.2 | 1.11.2 |
org.clojure:clojureMaven |
1.12.0-alpha1 up to 1.12.0-alpha9 | 1.12.0-alpha9 |
clojureAlpine:v3.19 |
1.2.0 up to 1.11.2-r0 | 1.11.2-r0 |
clojureAlpine:v3.20 |
1.2.0 up to 1.11.2-r0 | 1.11.2-r0 |
clojureAlpine:v3.21 |
1.2.0 up to 1.11.2-r0 | 1.11.2-r0 |
clojureAlpine:v3.22 |
1.2.0 up to 1.11.2-r0 | 1.11.2-r0 |
clojureAlpine:v3.23 |
1.2.0 up to 1.11.2-r0 | 1.11.2-r0 |
clojureAlpine:v3.24 |
1.2.0 up to 1.11.2-r0 | 1.11.2-r0 |
clojureDebian:12 |
All versions, plus listed versions 1.11.1-21.11.2-11.12.0-11.12.5-11.12.5-2 |
None known |
clojureDebian:13 |
before 1.11.2-1 | 1.11.2-1 |
Show 14 moreShow less
| Package | Affected | Fixed |
|---|---|---|
clojureDebian:14 |
before 1.11.2-1 | 1.11.2-1 |
org.clojure:clojureMaven |
1.7.0 up to 1.11.2, plus listed versions 1.10.01.10.0-RC11.10.0-RC21.10.0-RC31.10.0-RC4 Show 45 moreShow less1.10.0-RC51.10.0-alpha11.10.0-alpha21.10.0-alpha31.10.0-alpha41.10.0-alpha51.10.0-alpha61.10.0-alpha71.10.0-alpha81.10.0-alpha91.10.0-beta11.10.0-beta21.10.0-beta31.10.0-beta41.10.0-beta51.10.0-beta61.10.0-beta71.10.0-beta81.10.11.10.1-RC11.10.1-beta11.10.1-beta21.10.1-beta31.10.21.10.2-alpha11.10.2-alpha21.10.2-alpha31.10.2-alpha41.10.2-rc11.10.2-rc21.10.2-rc31.10.31.10.3-rc11.11.01.11.0-alpha11.11.0-alpha21.11.0-alpha31.11.0-alpha41.11.0-beta11.11.0-rc11.11.11.11.1-rc11.8.01.8.0-RC11.8.0-RC2 |
1.11.2 |
org.clojure:clojureMaven |
1.12.0-alpha1 up to 1.12.0-alpha9, plus listed versions 1.12.0-alpha21.12.0-alpha31.12.0-alpha41.12.0-alpha51.12.0-alpha61.12.0-alpha71.12.0-alpha8 |
1.12.0-alpha9 |
clojureMageia:9 |
before 1.11.2-1.mga9 | 1.11.2-1.mga9 |
io.root.org.clojure:clojureRoot:Maven |
before 1.9.0-root.io.1 | 1.9.0-root.io.11.8.0-root.io.11.7.0-root.io.1 |
org.clojure:clojureRoot:Maven |
before 1.9.0-aikido.1 | 1.9.0-aikido.11.8.0-aikido.11.7.0-aikido.1 |
clojureUbuntu:18.04:LTS |
All versions, plus listed versions 1.8.0-31.9.0~alpha15-11.9.0~alpha15-21.9.0-21.9.0-6~18.04 |
None known |
clojureUbuntu:20.04:LTS |
All versions, plus listed versions 1.10.0-11.10.1-1 |
None known |
clojureUbuntu:22.04:LTS |
All versions, plus listed versions 1.10.2-1 |
None known |
clojureUbuntu:24.04:LTS |
All versions, plus listed versions 1.11.1-2 |
None known |
clojureUbuntu:25.10 |
All versions, plus listed versions 1.12.0-1 |
None known |
clojureUbuntu:26.10 |
All versions, plus listed versions 1.12.0-1build21.12.5-1 |
None known |
clojureUbuntu:26.04:LTS |
All versions, plus listed versions 1.12.0-11.12.0-1build2 |
None known |
clojureopenSUSE:Tumbleweed |
before 1.11.2.1446-1.1 | 1.11.2.1446-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-22871 is a high vulnerability (CVSS 7.5) in Clojure, published February 29, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.53%, the 74th percentile. Fixed in org.clojure:clojure 1.11.2.
References
hackmd.io/%40fe1w0/rymmJGida
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWWK2SO2MH4SXPO6L444MM6LHVLVFULV
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-22871
clojure.atlassian.net/browse/CLJ-2839
github.com/advisories/GHSA-vr64-r9qj-h27f
security.alpinelinux.org/vuln/CVE-2024-22871
security-tracker.debian.org/tracker/CVE-2024-22871
advisories.mageia.org/MGASA-2024-0093.html
bugs.mageia.org/show_bug.cgi?id=33012
ubuntu.com/security/CVE-2024-22871
cve.org/CVERecord?id=CVE-2024-22871
suse.com/security/cve/CVE-2024-22871
Left out here: 37 versions. The JSON record has them.