Log in Start free

Vulnerability · Published Sep 23, 2026 · Assigned by GitHub_M

CVE-2026-77422JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping

High 7.5

In plain English

A high-severity regular-expression denial of service in jline3 from jline. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.6%top 51.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12jline3no fix listedDEBIAN-CVE-2026-77422
Debian:13jline3no fix listedDEBIAN-CVE-2026-77422
Debian:14jline3no fix listedDEBIAN-CVE-2026-77422
Mavenorg.jline:jline-builtins4.3.1GHSA-r2xf-8xr9-62gw
Mavenorg.jline:jline-builtins3.30.15GHSA-r2xf-8xr9-62gw
Ubuntu:22.04:LTSjlineno fix listedUBUNTU-CVE-2026-77422
Ubuntu:24.04:LTSjlineno fix listedUBUNTU-CVE-2026-77422
Ubuntu:26.04:LTSjlineno fix listedUBUNTU-CVE-2026-77422
Ubuntu:26.10jlineno fix listedUBUNTU-CVE-2026-77422
Ubuntu:22.04:LTSjline2no fix listedUBUNTU-CVE-2026-77422
Ubuntu:24.04:LTSjline2no fix listedUBUNTU-CVE-2026-77422
Ubuntu:26.04:LTSjline2no fix listedUBUNTU-CVE-2026-77422
Ubuntu:26.10jline2no fix listedUBUNTU-CVE-2026-77422
Ubuntu:22.04:LTSjline3no fix listedUBUNTU-CVE-2026-77422
Ubuntu:24.04:LTSjline3no fix listedUBUNTU-CVE-2026-77422
Ubuntu:26.04:LTSjline3no fix listedUBUNTU-CVE-2026-77422
Ubuntu:26.10jline3no fix listedUBUNTU-CVE-2026-77422

Affected products (as reported)

VendorProductVersions
jline jline3 >= 3.0.0, < 3.30.15>= 4.0.0, < 4.3.1

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References