Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2026-77420: JLine library can freeze console with crafted config
CVE-2026-77420 · published 1 month ago
Summary
The JLine Java library used for console input can be made to consume all CPU when a specially crafted HISTOR Y_IGNORE setting is used. This occurs in versions from 3.0.0 up to 3.30.15 and in 4.0‑4.3.0, potentially hanging the application that reads commands. Upgrade to version 3.30.15 or later, or 4.3.1 or later, to stop the problem.
What to do
- Update org.jline:jline-reader to version 4.3.1.
- Update org.jline:jline-reader to version 3.30.15.
- Update jline org.jline:jline-reader to version 4.3.1.
- Update jline org.jline:jline-reader to version 3.30.15.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | – | org.jline:jline-reader |
>= 4.0.0, < 4.3.1 >= 3.0.0, < 3.30.15 Fix: upgrade to 4.3.1
|
| – | jline | jline3 | >= 3.0.0, < 3.30.15 |
| maven | jline | org.jline:jline-reader |
>= 4.0.0, < 4.3.1 >= 3.0.0, < 3.30.15 Fix: upgrade to 4.3.1
|
| Ubuntu:14.04:LTS | canonical | jline | All versions |
| Ubuntu:14.04:LTS | canonical | jline2 | All versions |
| Ubuntu:22.04:LTS | canonical | jline3 | All versions |
| Debian:12 | debian | jline3 | All versions |
Original advisory text
JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1.
References
- https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3 Vendor Advisory
- https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541 Patch
- https://github.com/advisories/GHSA-5q95-hrpc-m3w3
- https://github.com/jline/jline3/pull/2018 Patch
- https://github.com/jline/jline3/releases/tag/4.3.1 URL
- https://github.com/jline/jline3/releases/tag/jline-3.30.15 URL
- https://ubuntu.com/security/CVE-2026-77420 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-77420 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77420... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-77420 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-77420 Vendor Advisory
- https://github.com/jline/jline3 Product
- https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae Patch
- https://github.com/jline/jline3/pull/2012 Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-1333Inefficient Regular Expression Complexity (ReDoS)
Timeline
Published23 Sep 2026
Updated3 Nov 2026
First seen23 Sep 2026
Sources
CVE-2026-77420 · NVD
CVE-2026-77420 · MITRE
GHSA-5q95-hrpc-m3w3 · GHSA
UBUNTU-CVE-2026-77420 · OSV
CVE-2026-77420 · OSV
DEBIAN-CVE-2026-77420 · OSV
GHSA-5q95-hrpc-m3w3 · OSV
Track software like this
Free during beta