CVE-2024-22871

What it actually does

A flaw in the clojure.core$partial$fn__5920 function allows remote attackers to trigger a denial of service condition by sending specially crafted inputs that cause the application to become unresponsive or crash.

Why it matters to the business

Applications built with affected Clojure versions may experience unexpected downtime or degraded performance, impacting user access and operational continuity until the issue is resolved.

How an attack unfolds

An attacker identifies a Clojure-based application and sends malicious requests that invoke the vulnerable partial function, leading to resource exhaustion or crash.

How to fix it

Upgrade to the fixed version in commit 218054f1f2ddfc69ef4f9d17f916de35e4a4effe or later.

How to confirm the fix worked

Verify the Clojure version is updated beyond 1.12.0-alpha5 and test that the partial function behaves correctly without crashing on edge cases.

Typical attack path

1. Identify vulnerable Clojure application
2. Craft input targeting clojure.core$partial$fn__5920
3. Send request to trigger DoS
4. Observe service unavailability

How to detect it

Review application logs for crashes or high resource usage around the partial function; check for anomalous requests that may trigger the vulnerability.

What your security team should do

• Update Clojure to the fixed commit immediately
• Monitor for unusual traffic patterns that could indicate attempted exploitation
• Review all dependencies for other affected Clojure versions