Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2023-51079: MVEL 2.5.0.Final may take a long time to parse large expressions
CVE-2023-51079 · published 2 years ago
Summary
Using MVEL 2.5.0.Final to parse complex expressions can cause slow performance. This means that your application may take longer than expected to process certain tasks. If you're experiencing slow parsing times, consider upgrading to a newer version of MVEL or exploring alternative parsing solutions.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | mvel | org.mvel:mvel2 | 2.5.0.Final |
| – | mvel | mvel |
2.5.0 cpe:2.3:a:mvel:mvel:2.5.0:*:*:*:*:*:*:* |
Original advisory text
A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because "the only thing that you...
A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because "the only thing that you could expect is that the parser will take a crazy amount of time to complete its task."
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published27 Dec 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta