CVE-2026-77422High· 7.5▾ TwilightJLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.jline:jline-builtins >= 4.0.0, < 4.3.1org.jline:jline-builtins >= 3.0.0, < 3.30.15Patched in:
org.jline:jline-builtins 4.3.1org.jline:jline-builtins 3.30.15Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77420Medium· 5.5JLine is a Java library for handling console input
CVE-2026-77421Medium· 6.5JLine is a Java library for handling console input
CVE-2026-77423High· 7.5JLine is a Java library for handling console input
CVE-2024-21538High· 7.5Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization
CVE-2024-21490High· 7.5This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0
GHSA-2r2c-cx56-8933High· 7.5JLine3 Telnet server: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry