GitHub Advisoryadvisory · Maven

GHSA-h63j-xqx6-w58r mvel2 TimeOut error exists in the ParseTools.subCompileExpression method

MEDIUM Published 2023-12-27 Modified 2024-01-08 Official page ↗

Aliases: CVE-2023-51079
Ecosystem: Maven
Packages: org.mvel:mvel2
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Reviewed: 2023-12-28

Affected packages

• Maven org.mvel:mvel2: 2.5.0.Final (no fix yet)

Description

A TimeOut error exists in the ParseTools.subCompileExpression method in mvel2 v2.5.0 Final.

Related

Alias · CVE (1)

CVE-2023-51079 A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. vulnerability

References