Vulnerability · Published Sep 23, 2026 · Assigned by GitHub_M

CVE-2026-77421JLine: ReDoS in Nano Editor Regex Search Mode

Medium 6.5

In plain English

A medium-severity regular-expression denial of service in jline3 from jline. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 62.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	jline3	no fix listed	DEBIAN-CVE-2026-77421
Debian:13	jline3	no fix listed	DEBIAN-CVE-2026-77421
Debian:14	jline3	no fix listed	DEBIAN-CVE-2026-77421
Maven	org.jline:jline-builtins	4.3.1	GHSA-ph9c-7hw9-vhhw
Maven	org.jline:jline-builtins	3.30.15	GHSA-ph9c-7hw9-vhhw
Ubuntu:22.04:LTS	jline	no fix listed	UBUNTU-CVE-2026-77421
Ubuntu:24.04:LTS	jline	no fix listed	UBUNTU-CVE-2026-77421
Ubuntu:26.04:LTS	jline	no fix listed	UBUNTU-CVE-2026-77421
Ubuntu:26.10	jline	no fix listed	UBUNTU-CVE-2026-77421
Ubuntu:22.04:LTS	jline2	no fix listed	UBUNTU-CVE-2026-77421
Ubuntu:24.04:LTS	jline2	no fix listed	UBUNTU-CVE-2026-77421
Ubuntu:26.04:LTS	jline2	no fix listed	UBUNTU-CVE-2026-77421
Ubuntu:26.10	jline2	no fix listed	UBUNTU-CVE-2026-77421
Ubuntu:22.04:LTS	jline3	no fix listed	UBUNTU-CVE-2026-77421
Ubuntu:24.04:LTS	jline3	no fix listed	UBUNTU-CVE-2026-77421
Ubuntu:26.04:LTS	jline3	no fix listed	UBUNTU-CVE-2026-77421
Ubuntu:26.10	jline3	no fix listed	UBUNTU-CVE-2026-77421

Affected products (as reported)

Vendor	Product	Versions
jline	jline3	>= 3.0.0, < 3.30.15>= 4.0.0, < 4.3.1

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/jline/jline3/security/advisories/GHSA-ph9c-7hw9-vhhw x_refsource_CONFIRM
https://github.com/jline/jline3/pull/2012 x_refsource_MISC
https://github.com/jline/jline3/pull/2018 x_refsource_MISC
https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541 x_refsource_MISC
https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae x_refsource_MISC
https://github.com/jline/jline3/releases/tag/4.3.1 x_refsource_MISC
https://github.com/jline/jline3/releases/tag/jline-3.30.15 x_refsource_MISC