CVE-2023-51079
mvel2 TimeOut error exists in the ParseTools.subCompileExpression method
A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because "the only thing that you could expect is that the parser will take a crazy amount of time to complete its task."
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because "the only thing that you could expect is that the parser will take a crazy amount of time to complete its task."
- Record
CVE-2023-51079- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
CVE List No score
A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because "the only thing that you could expect is that the parser will take a crazy amount of time to complete its task."
- Record
CVE-2023-51079- Updated
- 2026-11-02
EUVDEUVD-2023-3218 No score
A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because "the only thing that you could expect is that the parser will take a crazy amount of time to complete its task."
- Record
EUVD-2023-3218- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h63j-xqx6-w58r
mvel2 TimeOut error exists in the ParseTools.subCompileExpression method
A TimeOut error exists in the ParseTools.subCompileExpression method in mvel2 v2.5.0 Final.
- Record
GHSA-h63j-xqx6-w58r- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVGHSA-h63j-xqx6-w58r
mvel2 TimeOut error exists in the ParseTools.subCompileExpression method
A TimeOut error exists in the ParseTools.subCompileExpression method in mvel2 v2.5.0 Final.
- Record
GHSA-h63j-xqx6-w58r- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.mvel:mvel2Maven |
2.5.0.Final to 2.5.0.Final | None known |
org.mvel:mvel2Maven |
Listed versions 2.5.0.Final |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-51079 is a medium vulnerability (CVSS 5.3) in Mvel, published December 27, 2023. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile.