JLine3, a Java library for console input handling, has a vulnerability (CWE-1333) in its built-in grep command where user-supplied regular expressions are automatically wrapped with '.*' prefixes and suffixes unless line-regexp mode is used. This wrapping increases the complexity of the backtracking regular expression engine in Java, leading to excessive CPU usage and potential indefinite blocking when processing certain nested-quantifier expressions against non-matching input. This can affect remotely exposed shell sessions. The vulnerability affects versions >=3.0.0 <3.30.15 and >=4.0.0 <4.3.1 and is fixed in 3.30.15 and 4.3.1.

The vulnerability can cause denial of service by consuming excessive CPU resources and indefinitely blocking command workers, potentially impacting availability of services using affected JLine3 versions. There is no impact on confidentiality or integrity. The CVSS score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Upgrade to JLine3 version 3.30.15 or later, or 4.3.1 or later, where this vulnerability is fixed. No other mitigation or workaround is indicated in the available data.