JLine3 EUVD-2026-85527

Exploitation requires an application that (1) depends on org.jline:jline-builtins in a vulnerable range (>=3.0.0 <3.30.15 or >=4.0.0 <4.3.1) and (2) exposes the built-in grep command to attacker-controllable pattern input, typically via a remote or interactive JLine shell. The specific trigger is the code path for non-line-regexp searches, where the user pattern is auto-wrapped as '.*'+pattern+'.*' and compiled with Java's backtracking engine; supplying a pathological pattern like '(a+)+b' against non-matching input causes catastrophic backtracking. Limiting factors: the grep builtin must actually be reachable by the attacker (many embedders never expose it or gate it behind authentication), impact is confined to CPU/thread exhaustion (no data or code impact), and the '--line-regexp' path is not affected by the '.*' wrapping. If grep is not exposed to untrusted users, the vulnerability is not reachable.

This is a CWE-1333 regular-expression denial-of-service (ReDoS) in JLine3's built-in grep command. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) rates it high, but the real-world risk is heavily gated by deployment: it only bites applications that embed org.jline:jline-builtins AND expose the built-in grep command to attacker-supplied input, typically via a remote/interactive shell. There is no EPSS score, no CISA KEV listing, and no independent exploit weaponization reported - however a working PoC ('grep '(a+)+b'' against a line of repeated 'a's) is published in the GHSA advisory, so exploitation is trivially reproducible for anyone who reaches the grep prompt. Impact is availability-only (C:N/I:N); it occupies a worker thread with catastrophic backtracking rather than corrupting data or executing code. The AV:N and PR:N in the vendor vector describe the most exposed configuration (a network-reachable shell), but many embedders either do not expose grep at all or place it behind an authenticated session - so for most deployments this is a moderate, condition-dependent hardening fix rather than an urgent priority. Signals are internally consistent (high-CVSS on availability, PoC present, no active exploitation), pointing to a real but low-urgency DoS.

An application embeds jline-builtins and exposes the built-in grep command through a network-accessible interactive shell. An attacker submits a crafted pattern such as '(a+)+b' against input that never matches, triggering catastrophic backtracking that pins a worker thread at 100% CPU; repeating this across sessions degrades availability for other users. A public PoC exists in the vendor GHSA advisory.