JLine CVE-2026-77420

Exploitation requires the attacker to control the JLine HISTORY_IGNORE variable via user configuration or application settings, and to submit a command line that does not match the crafted pattern so the regex engine backtracks fully. It only affects applications embedding org.jline:jline-reader (versions >=3.0.0 <3.30.15 or >=4.0.0 <4.3.1) that expose HISTORY_IGNORE to untrusted or lower-privileged input; applications that hardcode or do not use HISTORY_IGNORE are not exposed. Impact is limited to denial of service (hung reader thread, high CPU) with no confidentiality or integrity effect, and the attack vector is local (AV:L) requiring low privileges (PR:L).

This is a low-to-moderate real-world priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) correctly frames it as an availability-only, local, low-privilege issue with no confidentiality or integrity impact - CWE-1333 catastrophic-backtracking ReDoS. Crucially, exploitation is gated on the attacker controlling the HISTORY_IGNORE configuration variable, which is not a typical unauthenticated-network exposure; the vendor advisory itself notes it is 'lower severity than the interactive editor findings because the attacker must control configuration.' A working PoC is published in the GHSA advisory (pattern (a+)+b plus a long non-matching input line reliably hangs the reader thread), so publicly available exploit code exists, but there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation in the provided data. No SSVC decision data is supplied. The signals are internally consistent: local vector, config-dependent, DoS-only, patched - this is a hardening/defense-in-depth fix rather than an urgent emergency, most relevant to applications that let untrusted parties supply JLine configuration.

An application embedding jline-reader lets users or lower-privileged operators set the HISTORY_IGNORE variable through configuration or application settings. An attacker sets it to a pathological regex such as (a+)+b, then submits a long non-matching command line (e.g. aaaa...x); each history add triggers catastrophic backtracking, pinning the reader thread at 100% CPU and hanging the session. A reproducible PoC is published in the vendor's GHSA advisory.