CVE-2026-77420Medium· 5.5▾ SunlitJLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HIS…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.jline:jline-reader >= 4.0.0, < 4.3.1org.jline:jline-reader >= 3.0.0, < 3.30.15Patched in:
org.jline:jline-reader 4.3.1org.jline:jline-reader 3.30.15Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77421Medium· 6.5JLine is a Java library for handling console input
CVE-2026-77422High· 7.5JLine is a Java library for handling console input
CVE-2026-77423High· 7.5JLine is a Java library for handling console input
CVE-2024-21538High· 7.5Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization
CVE-2024-21490High· 7.5This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0
GHSA-2r2c-cx56-8933High· 7.5JLine3 Telnet server: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry