CVE-2023-51079 in mvel dependency

[problemzebra2]

The mvel dependecy

 <dependency>
    >groupId>org.mvel</groupId>
   <artifactId>mvel2</artifactId>
   <version>${mvel.version}</version>
</dependency>

in version 2.5.1.Final has a security issue (CVE-2023-51079)

As of now, there seems to be no updated version of mvel available:

mvel/mvel#348

[cjmamo]

I'm following mvel/mvel#348 closely. At the moment, I'm assigning this low-priority because the Smooks codebase doesn't directly call anywhere ParseTools.subCompileExpression. Apart from this, there doesn't seem to be consensus among the MVEL maintainers whether this is a security issue. Having said this, we might need to have a broader discussion on how Smooks should handle unexpected large payloads.