CVE-2026-77420: CWE-1333: Inefficient Regular Expression Complexity in jline jline3
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1.
AI Analysis
Technical Summary
The vulnerability in jline3 involves the DefaultHistory.matchPatterns method converting the HISTORY_IGNORE configuration value into a Java regular expression with incomplete escaping. This allows regex metacharacters, specifically nested quantifiers, to reach the backtracking engine, causing excessive CPU usage and indefinite blocking of the reader thread when commands are added to history. The flaw affects versions >=3.0.0 <3.30.15 and >=4.0.0 <4.3.1. The issue is resolved in versions 3.30.15 and 4.3.1.
Potential Impact
An attacker who can control the application or user configuration can supply crafted nested-quantifier regex expressions that cause excessive CPU consumption and indefinite blocking of the reader thread. This results in a denial of service condition affecting availability. There is no impact on confidentiality or integrity.
Mitigation Recommendations
This vulnerability is fixed in jline3 versions 3.30.15 and 4.3.1. Users should upgrade to these or later versions to remediate the issue. No additional mitigation is required if these versions are in use.
CVE-2026-77420: CWE-1333: Inefficient Regular Expression Complexity in jline jline3
Description
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1.
CVSS v3.1
Score 5.5medium
Affected software
jline
jline3
pkg:maven/org.jline/jline3Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in jline3 involves the DefaultHistory.matchPatterns method converting the HISTORY_IGNORE configuration value into a Java regular expression with incomplete escaping. This allows regex metacharacters, specifically nested quantifiers, to reach the backtracking engine, causing excessive CPU usage and indefinite blocking of the reader thread when commands are added to history. The flaw affects versions >=3.0.0 <3.30.15 and >=4.0.0 <4.3.1. The issue is resolved in versions 3.30.15 and 4.3.1.
Potential Impact
An attacker who can control the application or user configuration can supply crafted nested-quantifier regex expressions that cause excessive CPU consumption and indefinite blocking of the reader thread. This results in a denial of service condition affecting availability. There is no impact on confidentiality or integrity.
Mitigation Recommendations
This vulnerability is fixed in jline3 versions 3.30.15 and 4.3.1. Users should upgrade to these or later versions to remediate the issue. No additional mitigation is required if these versions are in use.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-20T19:59:59.603Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab4183ef7a7c541062636fa
Added to database: 09/23/2026, 18:19:42 UTC
Last enriched: 09/23/2026, 19:04:47 UTC
Last updated: 09/24/2026, 01:57:04 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.