CVE-2024-22871 Overview
CVE-2024-22871 is a denial of service (DoS) vulnerability affecting Clojure versions 1.20 through 1.12.0-alpha5. The flaw resides in the clojure.core$partial$fn__5920 function and is associated with insecure deserialization behavior [CWE-502]. A remote attacker can trigger the condition over the network without authentication or user interaction, exhausting application availability. The issue also affects Clojure packages distributed through Fedora 38, 39, and 40. Several Fedora package announcements have shipped updated builds to address the defect.
Critical Impact
A network-reachable attacker can cause a Clojure application to enter a denial of service state through the clojure.core$partial$fn__5920 function, disrupting service availability.
Affected Products
- Clojure versions 1.20 through 1.12.0-alpha5 (including alpha1 through alpha8 builds)
- Fedora 38, 39, and 40 distributions packaging affected Clojure builds
- Applications and services embedding the vulnerable Clojure runtime
Discovery Timeline
- 2024-02-29 - CVE-2024-22871 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-22871
Vulnerability Analysis
The vulnerability lives inside clojure.core$partial$fn__5920, an internal function generated from Clojure's partial higher-order function. When the function processes attacker-influenced input through unsafe deserialization paths, it can be coerced into resource-intensive computation. The result is a denial of service condition that disrupts availability of any process executing the vulnerable code.
The issue is classified as a Deserialization of Untrusted Data weakness [CWE-502]. Exploitation does not require authentication or user interaction, and the attack can be delivered remotely across the network. The EPSS score is 1.533% (71.5 percentile), indicating moderate observed exploitation probability for this class of issue.
Root Cause
The root cause is improper handling of untrusted data within the function returned by clojure.core/partial. When deserialized payloads reach this code path, the runtime performs operations that consume excessive CPU or memory, locking up the host process. The vulnerable behavior is present in stable releases through 1.20 and in 1.12.0 alpha builds up to alpha5.
Attack Vector
An unauthenticated attacker delivers crafted input to a Clojure application that processes serialized data through the affected partial function path. Because the attack vector is network-based with low complexity, services exposing Clojure-based endpoints — REST APIs, message consumers, or RPC handlers — are the primary risk surface. No code execution or data disclosure occurs; the impact is limited to availability loss.
For additional technical context, see the HackMD Security Overview.
Detection Methods for CVE-2024-22871
Indicators of Compromise
- Sudden CPU saturation or out-of-memory conditions in Java Virtual Machine (JVM) processes hosting Clojure applications
- Unresponsive Clojure service endpoints following receipt of unusually structured serialized payloads
- Thread dumps showing prolonged execution within clojure.core$partial$fn__5920 frames
Detection Strategies
- Inventory all Clojure runtimes and dependencies to identify versions in the 1.20 through 1.12.0-alpha5 range
- Inspect application logs for repeated request timeouts or worker thread starvation correlated with deserialization activity
- Use software composition analysis (SCA) tooling to flag vulnerable Clojure artifacts in build pipelines and container images
Monitoring Recommendations
- Track JVM heap utilization, garbage collection pauses, and thread counts on Clojure-hosting services
- Alert on anomalous request payload sizes or content types reaching deserialization endpoints
- Monitor Fedora package update channels and apply advisories referenced in the Fedora package announcements
How to Mitigate CVE-2024-22871
Immediate Actions Required
- Upgrade Clojure to a fixed release beyond the affected 1.20 through 1.12.0-alpha5 range
- Apply Fedora updates referenced in the Fedora Package Announcement advisories for Fedora 38, 39, and 40
- Restrict network exposure of Clojure services that accept serialized input from untrusted sources
Patch Information
Fedora has shipped updated Clojure packages through the package-announce mailing list. Refer to the advisories at Fedora 38/39/40 Package Announcements and the additional Fedora advisory for the specific package versions that contain the fix. Update vulnerable Clojure builds to a release that no longer includes the defective code path in clojure.core$partial$fn__5920.
Workarounds
- Validate and constrain the size, structure, and source of any data deserialized by Clojure applications
- Place rate limiting and request timeouts in front of endpoints that invoke partial against untrusted input
- Isolate Clojure workloads behind authenticated gateways to reduce the unauthenticated attack surface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
