CVE-2026-77421: CWE-1333: Inefficient Regular Expression Complexity in jline jline3
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1.
AI Analysis
Technical Summary
JLine3's built-in nano editor's regex search mode passes user-supplied search terms directly to Java's backtracking regex engine without any timeout or backtracking bounds. This allows nested-quantifier expressions to cause excessive CPU usage and indefinite blocking of the editor session thread when evaluated against non-matching buffer content. In multi-user remote deployments, this can result in loss of worker threads per affected session. The vulnerability affects versions >=3.0.0 <3.30.15 and >=4.0.0 <4.3.1 and is resolved in versions 3.30.15 and 4.3.1.
Potential Impact
The vulnerability can cause denial of service by consuming excessive CPU resources and indefinitely blocking the editor session thread. In remote multi-user environments, this can lead to loss of worker threads for each affected session, potentially degrading service availability. There is no impact on confidentiality or integrity.
Mitigation Recommendations
This issue is fixed in JLine3 versions 3.30.15 and 4.3.1. Users should upgrade to these or later versions to remediate the vulnerability. No other mitigation or workaround is indicated.
CVE-2026-77421: CWE-1333: Inefficient Regular Expression Complexity in jline jline3
Description
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1.
CVSS v3.1
Score 6.5medium
Affected software
jline
jline3
pkg:maven/org.jline/jline3Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
JLine3's built-in nano editor's regex search mode passes user-supplied search terms directly to Java's backtracking regex engine without any timeout or backtracking bounds. This allows nested-quantifier expressions to cause excessive CPU usage and indefinite blocking of the editor session thread when evaluated against non-matching buffer content. In multi-user remote deployments, this can result in loss of worker threads per affected session. The vulnerability affects versions >=3.0.0 <3.30.15 and >=4.0.0 <4.3.1 and is resolved in versions 3.30.15 and 4.3.1.
Potential Impact
The vulnerability can cause denial of service by consuming excessive CPU resources and indefinitely blocking the editor session thread. In remote multi-user environments, this can lead to loss of worker threads for each affected session, potentially degrading service availability. There is no impact on confidentiality or integrity.
Mitigation Recommendations
This issue is fixed in JLine3 versions 3.30.15 and 4.3.1. Users should upgrade to these or later versions to remediate the vulnerability. No other mitigation or workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-20T19:59:59.603Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab4183ef7a7c541062636fb
Added to database: 09/23/2026, 18:19:42 UTC
Last enriched: 09/23/2026, 18:50:06 UTC
Last updated: 09/24/2026, 02:24:47 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.