{"id":"CVE-2017-20189","aliases":["GHSA-jgxc-8mwq-9xqw"],"url":"https://o3.security/vulnerability/CVE-2017-20189","summary":"Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization","details":"In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. This is relevant if a server deserializes untrusted objects.","published":"2024-01-22T06:15:07.563Z","modified":"2026-07-08T11:48:03.798738Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.01332,"percentile":0.68489,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":2,"affectedPackages":[{"ecosystem":"Maven","name":"org.clojure:clojure","fixedVersion":"1.9.0"}],"fix":{"url":"https://github.com/clojure/clojure/commit/271674c9b484d798484d134a5ac40a6df15d3ac3","label":"clojure/clojure@271674c"},"references":[{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20241108-0002/"},{"type":"FIX","url":"https://clojure.atlassian.net/browse/CLJ-2204"},{"type":"FIX","url":"https://github.com/clojure/clojure/commit/271674c9b484d798484d134a5ac40a6df15d3ac3"},{"type":"FIX","url":"https://github.com/frohoff/ysoserial/pull/68/files"},{"type":"FIX","url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGCLOJURE-5740378"},{"type":"EVIDENCE","url":"https://hackmd.io/%40fe1w0/HyefvRQKp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-20189"},{"type":"PACKAGE","url":"https://github.com/clojure/clojure"},{"type":"WEB","url":"https://groups.google.com/d/msg/clojure/WaL3hHzsevI/7zHU-L7LBQAJ"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20241108-0002"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T11:48:03.798738Z"}}