I think Google's warning definitely applies to Clojure. Most json libraries will convert string keys to keywords, and they're not weak references. An attacker

I think Google's warning definitely applies to Clojure. Most json libraries will convert string keys to keywords, and they're not weak references. An attacker can probably just send a few dozen gigabytes of random json to the average Clojure app and it's going to go down.