CVE-2026-77422
Received Received - Intake

ReDoS Vulnerability in JLine Console Library

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-77422
EUVD
EUVD-2026-85527

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
jline jline to 3.30.15 (inc)
jline jline 4.3.1
org.jline jline-builtins From 3.0.0 (inc) to 3.30.15 (exc)
org.jline jline-builtins to 4.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77422 is a denial-of-service vulnerability in the JLine3 library's built-in grep command. The issue occurs because the grep command automatically wraps user-supplied regular expressions with .* before compiling them, which amplifies catastrophic backtracking. This allows a short pattern like (a+)+b to cause the command to hang indefinitely on non-matching input, consuming high CPU resources.

Detection Guidance

To detect this vulnerability, check if your system uses JLine versions between 3.0.0 and 3.30.14 or below 4.3.1. Inspect installed packages for org.jline:jline-builtins. If exposed to remote users, monitor for high CPU usage from JLine grep commands processing regular expressions.

Impact Analysis

In environments where the JLine shell is exposed to remote users, this vulnerability can be exploited to occupy worker threads indefinitely, reducing service availability. The excessive CPU consumption can lead to system slowdowns or crashes.

Mitigation Strategies

Upgrade JLine to versions 3.30.15 or 4.3.1 or later. If upgrading is not possible, disable the vulnerable grep command in JLine shells or restrict access to shell sessions. Apply patches that modify grep to avoid automatic .* wrapping for non-line-regexp searches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77422. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart