CVE-2023-51075: 
Java vulnerability analysis and mitigation

The vulnerability CVE-2023-51075 affects hutool-core version 5.8.23, specifically in the StrSplitter.splitByRegex function. The vulnerability was discovered and disclosed in December 2023, allowing attackers to cause a Denial of Service (DoS) condition through manipulation of the first two parameters (NVD, MITRE).

The vulnerability exists in the StrSplitter.splitByRegex function where if the first two parameters are set to empty strings (""), the function enters an infinite loop regardless of how the other parameters are configured. This condition leads to either an Out of Memory (OOM) error or a Stack Overflow condition, ultimately causing the program to crash. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability results in a Denial of Service (DoS) condition, causing the application to either run out of memory or experience a stack overflow. This can lead to application crashes and service disruption, affecting the availability of systems using the vulnerable hutool-core component (NVD).

The vulnerability can be triggered by manipulating the first two parameters of the StrSplitter.splitByRegex function. A proof of concept exists demonstrating that setting both parameters to empty strings will cause the function to enter an infinite loop, making the vulnerability relatively straightforward to exploit (GitHub Issue).