CVE-2026-77423
Received Received - Intake

ReDoS in JLine Console Library via Malicious Regex Patterns

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier expression evaluated against non-matching lines can consume excessive CPU and indefinitely block the session thread, and repeated sessions in Telnet or SSH deployments can exhaust a bounded worker pool. This issue is fixed in versions 3.30.15 and 4.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-77423
EUVD
EUVD-2026-85531

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
jline jline to 3.30.15 (inc)
jline jline 4.3.1
org.jline jline to 3.30.14 (inc)
org.jline jline From 4.3.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77423 is a ReDoS vulnerability in the JLine library's built-in less viewer. User-controlled search patterns are passed directly to Java's regex engine without sanitization, allowing malicious patterns like (a+)+b to cause excessive CPU usage and freeze the session thread.

Detection Guidance

To detect this vulnerability, monitor for high CPU usage in Java processes running JLine, particularly during less viewer operations. Check for unresponsive SSH or Telnet sessions. Use commands like 'top -p $(pgrep -f jline)' or 'jstack <PID>' to identify CPU-intensive threads. Inspect logs for repeated failed regex pattern matches.

Impact Analysis

This vulnerability can cause denial-of-service by consuming 100% CPU and freezing sessions. In Telnet or SSH deployments, repeated attacks may exhaust worker pools, making the system unresponsive for legitimate users.

Mitigation Strategies

Upgrade JLine to versions 3.30.15 or 4.3.1 or later. If upgrading is not possible, disable the less viewer functionality in JLine or restrict access to SSH/Telnet services. Implement network-level rate limiting for SSH connections to prevent session pool exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77423. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart