CVE-2024-22871 – A vulnerability in Clojure versions 1.20 throug... (How to Fix)

Q: What is the severity of CVE-2024-22871?

CVE-2024-22871 has a CVSS score of 7.5 (HIGH). A vulnerability in Clojure versions 1.20 through 1.12.0-alpha5 allows attackers to cause denial of service (DoS) by exploiting the clojure.core$partial$fn__5920 function. This affects applications using vulnerable Clojure libraries or frameworks. The issue stems from deserialization of untrusted data leading to resource exhaustion.

📋 TL;DR

A vulnerability in Clojure versions 1.20 through 1.12.0-alpha5 allows attackers to cause denial of service (DoS) by exploiting the clojure.core$partial$fn__5920 function. This affects applications using vulnerable Clojure libraries or frameworks. The issue stems from deserialization of untrusted data leading to resource exhaustion.

💻 Affected Systems

Products:

Clojure programming language

Versions: 1.20 to 1.12.0-alpha5

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Applications using Clojure libraries or frameworks are vulnerable if they process untrusted data.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service unavailability due to resource exhaustion, potentially affecting dependent systems.

🟠

Likely Case

Degraded performance or temporary service disruption from targeted DoS attacks.

🟢

If Mitigated

Minimal impact with proper input validation and resource limits in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending malicious data to vulnerable applications.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.12.0-alpha6 and later

Vendor Advisory: https://clojure.org/security

Restart Required: Yes

Instructions:

1. Update Clojure to version 1.12.0-alpha6 or later. 2. Update project dependencies. 3. Restart affected applications.

🔧 Temporary Workarounds

Input validation

all

Validate and sanitize all input before processing with Clojure functions.

Resource limits

linux

Implement resource limits on Clojure application processes.

ulimit -v 1048576
systemctl set-property service MemoryMax=1G

🧯 If You Can't Patch

Isolate vulnerable systems from untrusted networks
Implement strict input validation and monitoring

🔍 How to Verify

Check if Vulnerable:

Check Clojure version in project dependencies or runtime.

Check Version:

clojure -M -e "(println (clojure-version))"

Verify Fix Applied:

Confirm Clojure version is 1.12.0-alpha6 or later.

📡 Detection & Monitoring

Log Indicators:

Unusual memory or CPU spikes
Application crashes related to clojure.core functions

Network Indicators:

High volume of requests to Clojure endpoints
Unusual payload patterns

SIEM Query:

source="application.logs" AND ("clojure.core$partial" OR "OutOfMemoryError")

📊 Metadata

CVE ID: CVE-2024-22871

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-502

Published: February 29, 2024

Last Updated: November 4, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-22871, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Clojure by Clojure

Clojure by Clojure

Clojure by Clojure

Clojure by Clojure

Clojure by Clojure

Clojure by Clojure

Clojure by Clojure

Clojure by Clojure

Clojure by Clojure

Fedora by Fedoraproject

Fedora by Fedoraproject

Fedora by Fedoraproject

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Input validation

Resource limits

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities