CVE-2023-51079

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because "the only thing that you could expect is that the parser will take a crazy amount of time to complete its task."

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected software

No affected versions have been published.

Timeline

Published
Dec 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-51087.2The Easy Newsletter Signups WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statemCVE-2023-510807.5The NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow.CVE-2023-510849.8hyavijava v6.0.07.1 was discovered to contain a stack overflow via the ResultConverter.convert2Xml method.CVE-2023-51095.4The WP Mailto Links – Protect Email Addresses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wpml_mailto' shortcode CVE-2023-510909.8Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formGetWeiXinConfig.CVE-2023-510919.8Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function R7WebsSecurityHandler.CVE-2023-510929.8Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade.CVE-2023-510939.8Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function fromSetLocalVlanInfo.CVE-2023-510949.8Tenda M3 V1.0.0.12(4856) was discovered to contain a Command Execution vulnerability via the function TendaTelnet.CVE-2023-510959.8Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formDelWlRfPolicy.CVE-2023-510979.8Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formSetAutoPing.CVE-2023-510989.8Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formSetDiagnoseInfo .
CVE-2023-51079: Medium severity, CVSS 5.3 | Vulnix