CVE-2026-77421
Received Received - Intake

ReDoS Vulnerability in JLine Console Editor

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-77421
EUVD
EUVD-2026-85522

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
jline jline to 3.30.15 (inc)
jline jline 4.3.1
jline jline to 3.30.14 (inc)
jline jline 3.30.15
jline jline to 4.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77421 is a denial-of-service vulnerability in the JLine library's nano editor regex search mode. User-controlled search terms are passed to Java's backtracking regex engine without timeout or backtracking limits. A crafted pattern like (a+)+b can cause excessive CPU consumption and hang the editor session indefinitely.

Detection Guidance

To detect this vulnerability, check if your system uses JLine versions between 3.0.0-3.30.14 or 4.0.0-4.3.0. Inspect Java applications using JLine for regex search features in the nano editor. Look for unusually high CPU usage in editor sessions or hanging threads during regex searches.

Impact Analysis

This vulnerability can cause high CPU usage and hang local editor sessions. In remote multi-user deployments, it can occupy server worker threads indefinitely, leading to denial of service for other users and potential system unavailability.

Mitigation Strategies

Upgrade JLine to versions 3.30.15 or 4.3.1 or later. If upgrading is not possible, disable regex search in the nano editor or implement strict timeouts for regex operations. Replace the backtracking regex engine with a linear-time engine like RE2J as a stronger mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77421. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart