{"action":"Upgrade org.clojure:clojure to 1.11.2 (1.11.x) or 1.12.0-alpha9 (1.12.x) or later.","affected":[{"fixed":"1.11.2","introduced":"1.7.0"},{"fixed":"1.12.0-alpha9","introduced":"1.12.0-alpha1"}],"component":"org.clojure:clojure","cve_ids":["CVE-2024-22871"],"ecosystem":"Maven","epss":0.01533,"exploited":false,"fixed_versions":["1.11.2","1.12.0-alpha9"],"ghsa_id":"GHSA-vr64-r9qj-h27f","id":"tcs_01M5N9EPYWBRR1M75JFKKEV0KQ","modified_at":"2026-09-10T03:50:10.079995576Z","published_at":"2024-02-29T03:33:18Z","references":["https://osv.dev/vulnerability/GHSA-vr64-r9qj-h27f","https://nvd.nist.gov/vuln/detail/CVE-2024-22871","https://clojure.atlassian.net/browse/CLJ-2839","https://github.com/clojure/clojure","https://hackmd.io/%40fe1w0/rymmJGida","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25FKUOYXQZGGJMFUM5HJABWMIX2TILRV","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWWK2SO2MH4SXPO6L444MM6LHVLVFULV","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YFPGUDXMW6OXKIDGCOZFEAXO74VQIB2T","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/25FKUOYXQZGGJMFUM5HJABWMIX2TILRV","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SWWK2SO2MH4SXPO6L444MM6LHVLVFULV","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YFPGUDXMW6OXKIDGCOZFEAXO74VQIB2T"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-vr64-r9qj-h27f","url":"https://osv.dev/vulnerability/GHSA-vr64-r9qj-h27f"}],"summary":"Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service"}