Vulnerability · Published Sep 23, 2026 · Assigned by GitHub_M
CVE-2026-77421JLine: ReDoS in Nano Editor Regex Search Mode
Medium 6.5
In plain English
A medium-severity regular-expression denial of service in jline3 from jline. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | jline3 | no fix listed | DEBIAN-CVE-2026-77421 |
| Debian:13 | jline3 | no fix listed | DEBIAN-CVE-2026-77421 |
| Debian:14 | jline3 | no fix listed | DEBIAN-CVE-2026-77421 |
| Maven | org.jline:jline-builtins | 4.3.1 | GHSA-ph9c-7hw9-vhhw |
| Maven | org.jline:jline-builtins | 3.30.15 | GHSA-ph9c-7hw9-vhhw |
| Ubuntu:22.04:LTS | jline | no fix listed | UBUNTU-CVE-2026-77421 |
| Ubuntu:24.04:LTS | jline | no fix listed | UBUNTU-CVE-2026-77421 |
| Ubuntu:26.04:LTS | jline | no fix listed | UBUNTU-CVE-2026-77421 |
| Ubuntu:26.10 | jline | no fix listed | UBUNTU-CVE-2026-77421 |
| Ubuntu:22.04:LTS | jline2 | no fix listed | UBUNTU-CVE-2026-77421 |
| Ubuntu:24.04:LTS | jline2 | no fix listed | UBUNTU-CVE-2026-77421 |
| Ubuntu:26.04:LTS | jline2 | no fix listed | UBUNTU-CVE-2026-77421 |
| Ubuntu:26.10 | jline2 | no fix listed | UBUNTU-CVE-2026-77421 |
| Ubuntu:22.04:LTS | jline3 | no fix listed | UBUNTU-CVE-2026-77421 |
| Ubuntu:24.04:LTS | jline3 | no fix listed | UBUNTU-CVE-2026-77421 |
| Ubuntu:26.04:LTS | jline3 | no fix listed | UBUNTU-CVE-2026-77421 |
| Ubuntu:26.10 | jline3 | no fix listed | UBUNTU-CVE-2026-77421 |
Affected products (as reported)
Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/jline/jline3/security/advisories/GHSA-ph9c-7hw9-vhhw x_refsource_CONFIRM
- https://github.com/jline/jline3/pull/2012 x_refsource_MISC
- https://github.com/jline/jline3/pull/2018 x_refsource_MISC
- https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541 x_refsource_MISC
- https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae x_refsource_MISC
- https://github.com/jline/jline3/releases/tag/4.3.1 x_refsource_MISC
- https://github.com/jline/jline3/releases/tag/jline-3.30.15 x_refsource_MISC