org.clojure vulnerabilities

Products

• org.clojure/clojure 2

Latest org.clojure CVEs

Newest publication first

1. CVE-2024-22871 Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service

   Published 2024-02-29

   High·CVSS 7.5

   An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.

2. CVE-2017-20189 Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization

   Published 2024-01-22

   Critical·CVSS 9.8

   In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.