CVE-2023-50572: 
Java vulnerability analysis and mitigation

An issue was identified in the GroovyEngine.execute component of jline-groovy version 3.24.1, tracked as CVE-2023-50572. The vulnerability was discovered and reported on December 7, 2023, and officially published on December 29, 2023. This security flaw affects the jline3 package, particularly version 3.24.1 (NVD, Ubuntu).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium severity) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The attack requires local access and user interaction, but no privileges are needed to execute. While the scope is unchanged and there are no impacts on confidentiality or integrity, the vulnerability can have a high impact on system availability (NVD).

When successfully exploited, this vulnerability allows attackers to trigger an Out-of-Memory (OOM) error in the affected system. This can lead to significant availability issues, potentially causing system instability or service disruption (NVD).

A fix has been implemented in jline-parent version 3.25.0. Organizations using affected versions should upgrade to the patched version. The vulnerable code was initially introduced in version 3.16.0, and systems running versions prior to this are not affected (Ubuntu).