Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service
Any program on the JVM may read serialized objects via java.io.ObjectInputStream.readObject(). Reading serialized objects from an untrusted source is inherently unsafe (this affects any program running on any version of the JVM) and is a prerequisite for this vulnerability.
Clojure classes that represent infinite seqs (Cycle, infinite Repeat, and Iterate) do not define hashCode() and use the parent ASeq.hashCode(), which walks the seq to compute the hash, yielding an infinite loop. Classes like java.util.HashMap call hashCode() on keys during deserialization of a serialized map.
The exploit requires:
- Crafting a serialized HashMap object with an infinite seq object as a key.
- Sending that to a program that reads serialized objects via ObjectInputStream.readObject().
This will cause the program to enter an infinite loop on the reading thread and thus a denial of service (DoS).
The affected Clojure classes (Cycle, Repeat, Iterate) exist in Clojure 1.7.0-1.11.1, 1.12.0-alpha1-1.12.0-alpha8.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.clojure:clojure | >= 1.7.0, < 1.11.2, >= 1.12.0-alpha1, < 1.12.0-alpha9 | 1.11.2, 1.12.0-alpha9 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-22871
- https://clojure.atlassian.net/browse/CLJ-2839
- https://github.com/clojure/clojure
- https://hackmd.io/%40fe1w0/rymmJGida
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25FKUOYXQZGGJMFUM5HJABWMIX2TILRV
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWWK2SO2MH4SXPO6L444MM6LHVLVFULV
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFPGUDXMW6OXKIDGCOZFEAXO74VQIB2T
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/25FKUOYXQZGGJMFUM5HJABWMIX2TILRV
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SWWK2SO2MH4SXPO6L444MM6LHVLVFULV
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFPGUDXMW6OXKIDGCOZFEAXO74VQIB2T
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-502- Platform
- Java / Kotlin (Maven)
- Package
org.clojure:clojure- Disclosed
- 29.02.2024
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-vr64-r9qj-h27f - CC BY 4.0
Vulnerability history: org.clojure:clojure
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 01.2024 02.2024
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 1
Disclosures per year
- 2024: 2
- 2025: 0
- 2026: 0
-
Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.