-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from Clojure's infinite sequence classes (Cycle, Repeat, Iterate) inheriting ASeq.hashCode() that walks the entire sequence. The exploit specifically uses clojure.core$partial$fn__5920 to construct malicious Iterate instances, as shown in the GenData.java PoC and Clojure verification scripts. This function's involvement in creating the problematic proxy objects is confirmed across multiple sources including NVD descriptions, Fedora advisories, and the HackMD technical analysis. The combination of 1) being part of the deserialization payload construction and 2) enabling infinite sequence creation makes this function directly vulnerable.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.clojure:clojure | maven | >= 1.7.0, < 1.11.2 | 1.11.2 |
| org.clojure:clojure | maven | >= 1.12.0-alpha1, < 1.12.0-alpha9 | 1.12.0-alpha9 |
Ongoing coverage of React2Shell