Skip to main content

JLine3 CVE-2026-77421

| EUVDEUVD-2026-85522 MEDIUM
Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)
2026-09-23 https://github.com/jline/jline3 GHSA-ph9c-7hw9-vhhw
Denial Of Service Java Red Hat Suse
6.5
CVSS 3.1 · Vendor: https://github.com/jline/jline3
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Authenticate to jline nano session
  2. Delivery
    Enable regex search mode
  3. Exploit
    Enter catastrophic pattern (a+)+b
  4. Execution
    Regex engine backtracks exponentially
  5. Persist
    Worker thread hangs at high CPU
  6. Impact
    Session denial of service

Vulnerability Assessment

Weakness
CWE
CWE-1333
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires an application that embeds org.jline:jline-builtins AND exposes the nano editor to a user, AND the user must enable nano's regex search mode (Pattern.LITERAL is used when regex mode is off, so default literal search is not vulnerable). For it to be a security-relevant DoS rather than self-harm, the deployment must be a remote, multi-user/shared service where an authenticated attacker (PR:L) can occupy a shared server worker thread; in a single-user local terminal the user can only hang their own session. No confidentiality/integrity exposure and no memory corruption - impact is limited to CPU exhaustion / thread hang of the affected session.
Impact

This is a genuine but low-urgency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is availability-only - no confidentiality or integrity impact, consistent with CWE-1333 (inefficient regex complexity / ReDoS). The vendor score is defensible, though the AV:N/PR:L combination is meaningful ONLY in the specific deployment where jline-builtins' nano editor is exposed to remote, authenticated multi-user sessions; in the far more common local single-user case the attacker can only hang their own session, which is self-inflicted and not a real security event. No EPSS score, no CISA KEV listing, and no packaged exploit tool are present in the input; however the GitHub Security Advisory (GHSA-ph9c-7hw9-vhhw) publishes complete step-by-step reproduction with the trivial trigger pattern '(a+)+b', so a working exploit is effectively public. No SSVC decision data was provided. Net: this is a real, easily-triggered availability bug against a narrow attack surface, not a high-priority mass-exploitation threat - prioritize patching only where the nano/less/grep builtins are exposed to untrusted or shared users.
Exploit ScenarioDerived

In a multi-user server that embeds org.jline:jline-builtins and exposes the nano editor to authenticated remote users, an attacker opens a file, toggles regex search mode, and enters a catastrophic-backtracking pattern such as '(a+)+b' against buffer content of repeated 'a' characters. The Java backtracking regex engine runs in exponential time, pinning the session/worker thread at high CPU and denying service. The advisory publishes full reproduction steps, so no exploit development is required.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 23, 2026

Catastrophic regex backtracking in the JLine3 nano editor's regex search mode allows an authenticated user to hang the editor session thread at high CPU, producing a denial of service. The flaw affects applications that embed org.jline:jline-builtins and expose the nano editor: jline-builtins 3.0.0 through 3.30.14 and 4.0.0 through 4.3.0 are impacted (CWE-1333, CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). A proof-of-concept reproduction, using a buffer of repeated 'a' characters and the pattern (a+)+b, is documented in the vendor advisory, and vendor-released patches exist in 3.30.15 and 4.3.1; no confirmed active exploitation (CISA KEV) or public exploit code beyond the advisory PoC has been reported. Practical severity depends on deployment: in a single-user local terminal the user only hangs their own session, whereas remote multi-user services that share worker threads can lose a server thread indefinitely.

RemediationAI

Upgrade org.jline:jline-builtins to a vendor-released patched version: 4.3.1 for the 4.x line or 3.30.15 for the 3.x line (vendor advisory GHSA-ph9c-7hw9-vhhw; fixes landed via PRs https://github.com/jline/jline3/pull/2012 and https://github.com/jline/jline3/pull/2018, commits 1d5fc3099e77938b971e197211cad2d4fbb17541 and 341ee69ccc57b7733c1b40d6993219b64b3206ae). If upgrading is not immediately possible, the most effective compensating control is to stop exposing the nano editor's regex search in multi-user or remote deployments - for example by disabling or not wiring the nano builtin, or by gating regex search behind a trusted/admin-only path - with the trade-off that users lose regex search entirely (literal search remains safe because it uses Pattern.LITERAL). Isolating each user session in its own process or container bounds the blast radius of a hung thread but does not prevent the per-session hang and increases resource overhead. Interposing a watchdog that interrupts or times out the search thread, or backporting the upstream SafeRegex/RegexTimeoutException wrapper, reduces the exposure but, as the vendor notes, is weaker than replacing the backtracking engine; note that switching to the linear-time RE2J engine changes regex semantics and drops support for backreferences and lookaround constructs in search patterns, so validate any user-facing regex behavior before adopting it. Because exploitation requires an authenticated user to enable regex mode and enter a crafted pattern, restricting who can reach an interactive nano session also lowers risk.

Affected VersionsENISA

jline3 4.0.0, < 4.3.1
jline3 3.0.0, < 3.30.15

Affected Packages

maven org.jline:jline-builtins fix: 3.30.15, 4.3.1
euvd jline3_3_0_0 fix: 3.30.15
euvd jline3_4_0_0 fix: 4.3.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

JLine3 is a Java library for building interactive console applications; its nano builtin implements a small text editor, and jline-builtins packages that editor for embedding. In builtins/src/main/java/org/jline/builtins/Nano.java, the doSearch(String text) method compiles the user-supplied search string with Pattern.compile(searchTerm, ...) and only adds Pattern.LITERAL when regex mode is disabled - so when the user toggles regex search, the raw Java regex engine is used with no backtracking bound or timeout. Java's java.util.regex engine is a backtracking matcher, so a nested-quantifier pattern such as (a+)+b evaluated against a long run of 'a' characters that never matches exhibits exponential-time behavior (CWE-1333, Inefficient Regular Expression Complexity). The vendor's fix routes matching through a SafeRegex utility backed by a linear-time engine (com.google.re2j) and a RegexTimeoutException guard; the same PR series also hardens related builtins - Less, Commands.history glob matching and PosixCommands.grep - that shared the same unchecked regex path. Because the regex is applied to buffer content synchronously on the session thread, the exhaustion manifests as a hung editor session rather than memory corruption or data exposure.

Know when Java gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/jline/jline3) PRIMARY 6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 6.5 MEDIUM

Availability-only thread-hang; PR:L because the attacker needs access to an exposed editor session, AC:L since the trigger pattern is trivial, C/I:N as no data is exposed or altered.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE MEDIUM
Red Hat 5.7 MEDIUM

Primary rating from Vendor (https://github.com/jline/jline3).

CVSS VectorVendor: https://github.com/jline/jline3

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

Summary

When regex search mode is enabled in the JLine3 nano editor, the user-supplied search term is compiled directly as a Java regular expression with no timeout or backtracking bound. A crafted pattern such as (a+)+b can hang the editor session thread at high CPU, causing a denial of service for that session.

Details

In builtins/src/main/java/org/jline/builtins/Nano.java, the search implementation uses Pattern.LITERAL only when regex mode is disabled. When regex mode is enabled, the search term is compiled as a raw Java regex:

java
Pattern pat = Pattern.compile(
        searchTerm,
        (searchCaseSensitive ? 0 : Pattern.CASE_INSENSITIVE | Pattern.UNICODE_CASE)
                | (searchRegexp ? 0 : Pattern.LITERAL));

This regex is then applied to buffer content. Because Java's regex engine is backtracking-based, nested-quantifier patterns can take exponential time on non-matching input.

Affected source location:

  • builtins/src/main/java/org/jline/builtins/Nano.java
  • doSearch(String text)

PoC

  1. Create a file containing a long run of a characters and open it in the JLine3

nano editor.

  1. Enable regex search mode with the editor's regex toggle.
  2. Start a search and enter the pattern (a+)+b.

Expected result:

  • The editor stops responding.
  • The session thread consumes high CPU.

Reproduction environment:

  • JLine3 on x86_64 Linux
  • OpenJDK 25.0.2

Impact

This is a denial-of-service vulnerability caused by catastrophic regex backtracking. Applications embedding org.jline:jline-builtins and exposing the nano editor are impacted. In local use, the user can hang their own session. In remote multi-user deployments, an attacker can occupy a server worker thread indefinitely.

Suggested Fix

The preferred fix for the current git head is to use a linear-time regex engine for regex search mode while preserving literal matching behavior when regex mode is off.

Suggested patch:

diff
diff --git a/builtins/pom.xml b/builtins/pom.xml
--- a/builtins/pom.xml
+++ b/builtins/pom.xml
@@
         <dependency>
+            <groupId>com.google.re2j</groupId>
+            <artifactId>re2j</artifactId>
+            <version>1.8</version>
+        </dependency>
+        <dependency>
             <groupId>org.jline</groupId>
             <artifactId>jline-reader</artifactId>
         </dependency>

diff --git a/builtins/src/main/java/org/jline/builtins/Nano.java b/builtins/src/main/java/org/jline/builtins/Nano.java
--- a/builtins/src/main/java/org/jline/builtins/Nano.java
+++ b/builtins/src/main/java/org/jline/builtins/Nano.java
@@
-import java.util.regex.Pattern;
+import com.google.re2j.Pattern;

If a dependency change is not acceptable, a fallback mitigation is to reject dangerous regex constructs or execute regex matching with a strict timeout, but that is weaker than replacing the backtracking engine.

Credits

This issue was identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 8 maven packages depend on org.jline:jline-builtins (6 direct, 2 indirect)

Ecosystem-wide dependent count for version 4.0.0.

Threat Intelligence Overview

EPSS Score
0.4%
Top 65% exploitable
Prevalence
Medium
JLine is a widely-used Java CLI library, but the exposed-nano attack surface is narrow
Threat Intel
1
1 sources
Exploit
POC
Public exploit code exists
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC Yes
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

52
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Java

View all
CVE-2012-4681 CRITICAL POC
9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
CVE-2015-7450 CRITICAL POC
9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
CVE-2013-2465 CRITICAL POC
9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2010-1871 HIGH POC
8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
CVE-2012-1723 CRITICAL POC
9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2015-4852 CRITICAL POC
9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL POC
9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
CVE-2017-3066 CRITICAL POC
9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
CVE-2012-0391 CRITICAL POC
9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-1333 – Inefficient Regular Expression Complexity (ReDoS)

View all
CVE-2023-29486 CRITICAL POC
9.8
CVE-2023-29487 CRITICAL POC
9.1
CVE-2026-48801 HIGH POC
8.7
CVE-2024-58340 HIGH POC
8.7
CVE-2026-0621 HIGH POC
8.7
CVE-2021-3807 HIGH POC
7.5
CVE-2024-21490 HIGH POC
7.5
CVE-2022-42969 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected
SUSE Linux Enterprise Server 16.0 Not-Affected
SUSE Linux Enterprise Server 16.0 Affected

References

Advisories & patches
PATCH https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541 PATCH https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae PATCH https://github.com/jline/jline3/pull/2012 PATCH https://github.com/jline/jline3/pull/2018 ADVISORY https://github.com/jline/jline3/security/advisories/GHSA-ph9c-7hw9-vhhw ADVISORY https://vuldb.com/vuln/409086 REF https://github.com/advisories/GHSA-ph9c-7hw9-vhhw REF https://github.com/jline/jline3/releases/tag/4.3.1 REF https://github.com/jline/jline3/releases/tag/jline-3.30.15

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy