Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-77422: JLine built-in grep can hang console
CVE-2026-77422 · published 1 month ago
Summary
The JLine library used for Java console input lets its built‑in grep command add extra characters to any search pattern you provide. This can cause the command to consume a lot of CPU and stop responding, especially when accessed over a remote shell. Upgrade to the latest JLine versions that include the fix.
What to do
- Update jline org.jline:jline-builtins to version 4.3.1.
- Update jline org.jline:jline-builtins to version 3.30.15.
- Update org.jline:jline-builtins to version 4.3.1.
- Update org.jline:jline-builtins to version 3.30.15.
- Update org.jline:jline-builtins to version 3.25.1-aikido.4.
- Update io.root.org.jline:jline-builtins to version 3.25.1-root.io.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | jline | org.jline:jline-builtins |
>= 4.0.0, < 4.3.1 >= 3.0.0, < 3.30.15 Fix: upgrade to 4.3.1
|
| maven | – | org.jline:jline-builtins |
>= 4.0.0, < 4.3.1 >= 3.0.0, < 3.30.15 Fix: upgrade to 4.3.1
|
| – | jline | jline3 | >= 3.0.0, < 3.30.15 |
| Ubuntu:14.04:LTS | canonical | jline | All versions |
| Ubuntu:14.04:LTS | canonical | jline2 | All versions |
| Ubuntu:22.04:LTS | canonical | jline3 | All versions |
| Debian:12 | debian | jline3 | All versions |
| Root:Maven | – | org.jline:jline-builtins |
< 3.25.1-aikido.4 Fix: upgrade to 3.25.1-aikido.4
|
| Root:Maven | – | io.root.org.jline:jline-builtins |
< 3.25.1-root.io.4 Fix: upgrade to 3.25.1-root.io.4
|
Original advisory text
JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.
References
- https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw Vendor Advisory
- https://github.com/jline/jline3/releases/tag/4.3.1 URL
- https://github.com/jline/jline3/releases/tag/jline-3.30.15 URL
- https://github.com/advisories/GHSA-r2xf-8xr9-62gw
- https://ubuntu.com/security/CVE-2026-77422 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-77422 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77422... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-77422 Vendor Advisory
- https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541 Patch
- https://github.com/jline/jline3/pull/2012 Patch
- https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae Patch
- https://github.com/jline/jline3/pull/2018 Patch
- https://security-tracker.debian.org/tracker/CVE-2026-77422 Vendor Advisory
- https://github.com/jline/jline3 Product
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-1333Inefficient Regular Expression Complexity (ReDoS)
Timeline
Published23 Sep 2026
Updated4 Nov 2026
First seen23 Sep 2026
Sources
CVE-2026-77422 · NVD
CVE-2026-77422 · MITRE
GHSA-r2xf-8xr9-62gw · GHSA
UBUNTU-CVE-2026-77422 · OSV
CVE-2026-77422 · OSV
DEBIAN-CVE-2026-77422 · OSV
GHSA-r2xf-8xr9-62gw · OSV
Track software like this
Free during beta