CVE-2024-22871

Vulnerability

Overview CVE-2024-22871 is a denial of service (DoS) vulnerability affecting Clojure versions 1.20 through 1.12.0-alpha5 [1][2]. The issue resides in the clojure.core$partial$fn__5920 function and stems from improper handling of specially crafted objects during deserialization, leading to uncontrolled hashcode computations [3].

Exploitation

Mechanism An attacker can exploit this vulnerability by providing malicious serialized data to a Clojure application that deserializes user-controlled input. The proof-of-concept demonstrates that by constructing objects with manipulated hash values (e.g., setting _hash to 1), the application enters a recursive hash calculation loop, exhausting CPU resources [2][3]. No authentication is required if the application exposes deserialization endpoints to unauthenticated users.

Impact

Successful exploitation results in a denial of service condition, rendering the affected service unresponsive due to excessive CPU consumption. The vulnerability can be triggered remotely without special privileges, making it a significant availability risk for systems running the affected Clojure versions [2][3].

Mitigation

As of the publication date, the vulnerability has not been patched; it affects Clojure up to version 1.12.0-alpha5. Users are advised to monitor the Clojure project for security updates and to restrict deserialization of untrusted data as a workaround [1][3].