CVE-2026-77423: CWE-1333: Inefficient Regular Expression Complexity in jline jline3
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier expression evaluated against non-matching lines can consume excessive CPU and indefinitely block the session thread, and repeated sessions in Telnet or SSH deployments can exhaust a bounded worker pool. This issue is fixed in versions 3.30.15 and 4.3.1.
AI Analysis
Technical Summary
JLine3 versions >=3.0.0 <3.30.15 and >=4.0.0 <4.3.1 contain an inefficient regular expression complexity vulnerability (CWE-1333) in the built-in less viewer. User-controlled search and display-filter patterns are passed directly to Java's backtracking regex engine, which can cause nested-quantifier expressions to consume excessive CPU when evaluated against non-matching lines. This results in indefinite blocking of the session thread and potential exhaustion of bounded worker pools in Telnet or SSH deployments. The issue is resolved in versions 3.30.15 and 4.3.1.
Potential Impact
The vulnerability allows an attacker to cause denial of service by supplying crafted regular expressions that consume excessive CPU resources and block session threads indefinitely. This can disrupt interactive sessions and exhaust worker pools in environments using Telnet or SSH, impacting availability. There is no impact on confidentiality or integrity.
Mitigation Recommendations
Upgrade affected JLine3 versions to 3.30.15 or later, or 4.3.1 or later, where this vulnerability is fixed. No other mitigation is indicated by the vendor advisory.
CVE-2026-77423: CWE-1333: Inefficient Regular Expression Complexity in jline jline3
Description
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier expression evaluated against non-matching lines can consume excessive CPU and indefinitely block the session thread, and repeated sessions in Telnet or SSH deployments can exhaust a bounded worker pool. This issue is fixed in versions 3.30.15 and 4.3.1.
CVSS v3.1
Score 7.5high
Affected software
jline
jline3
pkg:maven/org.jline/jline3Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
JLine3 versions >=3.0.0 <3.30.15 and >=4.0.0 <4.3.1 contain an inefficient regular expression complexity vulnerability (CWE-1333) in the built-in less viewer. User-controlled search and display-filter patterns are passed directly to Java's backtracking regex engine, which can cause nested-quantifier expressions to consume excessive CPU when evaluated against non-matching lines. This results in indefinite blocking of the session thread and potential exhaustion of bounded worker pools in Telnet or SSH deployments. The issue is resolved in versions 3.30.15 and 4.3.1.
Potential Impact
The vulnerability allows an attacker to cause denial of service by supplying crafted regular expressions that consume excessive CPU resources and block session threads indefinitely. This can disrupt interactive sessions and exhaust worker pools in environments using Telnet or SSH, impacting availability. There is no impact on confidentiality or integrity.
Mitigation Recommendations
Upgrade affected JLine3 versions to 3.30.15 or later, or 4.3.1 or later, where this vulnerability is fixed. No other mitigation is indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-20T19:59:59.603Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab41efff7a7c541062f1a94
Added to database: 09/23/2026, 18:48:31 UTC
Last enriched: 09/23/2026, 19:02:46 UTC
Last updated: 09/24/2026, 01:57:04 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.