CVE-2026-77420: JLine Java Library DOS Vulnerability

CVE-2026-77420 Overview

CVE-2026-77420 is a regular expression denial-of-service (ReDoS) vulnerability in JLine, a Java library for handling console input. The flaw resides in DefaultHistory.matchPatterns(String patterns, String line) inside reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java. The function converts the HISTORY_IGNORE configuration value into a Java regular expression but escapes only part of the regex syntax, letting other metacharacters reach the backtracking engine. An attacker who controls application or user configuration can supply a nested-quantifier pattern that is re-evaluated every time a command is added to history, consuming CPU and blocking the reader thread. The issue affects versions from 3.0.0 up to 3.30.15 and 4.3.1, and is tracked under [CWE-1333].

Critical Impact
A malicious HISTORY_IGNORE value triggers catastrophic backtracking on every command entry, indefinitely stalling the JLine reader thread and denying interactive console availability.

Affected Products

JLine 3.x from 3.0.0 through versions prior to 3.30.15
JLine 4.x prior to 4.3.1
Applications embedding JLine that expose HISTORY_IGNORE to user or external configuration

Discovery Timeline

2026-09-23 - CVE-2026-77420 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77420

Vulnerability Analysis

JLine's DefaultHistory class filters commands against user-controlled ignore patterns before appending them to the shell history. The matchPatterns method translates the HISTORY_IGNORE configuration string into a Java Pattern, but its escaping logic covers only a subset of regex metacharacters. Characters such as parentheses and quantifiers remain interpretable by the regex engine.

Because the pattern is compiled once and applied to every new history entry, a malicious configuration value containing nested quantifiers (for example, expressions of the form (a+)+) causes exponential backtracking. Each new command triggers the same expensive match, freezing the reader thread and preventing the user from interacting with the console.

The vulnerability requires local access and low privileges but produces high availability impact by exhausting CPU on the process hosting the JLine reader.

Root Cause

The root cause is incomplete input sanitization when translating shell-style ignore globs into a Java regular expression. Only certain metacharacters are escaped, leaving group and quantifier syntax intact. This allows attacker-controlled input to reach the backtracking regex engine unchecked, satisfying the conditions for [CWE-1333] Inefficient Regular Expression Complexity.

Attack Vector

Exploitation requires the ability to influence application or user configuration used by JLine, typically through environment variables, configuration files, or programmatic API calls that set HISTORY_IGNORE. Once a malicious pattern is loaded, the denial of service is triggered by any command added to history, including commands issued by the legitimate user.

java

// Patch excerpt: introduce SafeRegex guard against catastrophic backtracking
 import org.jline.terminal.Terminal;
 import org.jline.utils.AttributedStringBuilder;
 import org.jline.utils.AttributedStyle;
+import org.jline.utils.SafeRegex;
 import org.jline.utils.StyleResolver;

 import static org.jline.builtins.SyntaxHighlighter.*;
// Source: https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae

The patch introduces a SafeRegex utility and applies it to regex-matching call sites in Commands.java and Less.java, wrapping evaluation with protection against catastrophic backtracking.

Detection Methods for CVE-2026-77420

Indicators of Compromise

Java process hosting a JLine-based shell showing sustained single-thread CPU saturation with no forward progress on the reader thread.
Thread dumps that repeatedly show the reader thread executing java.util.regex.Pattern$* frames invoked from DefaultHistory.matchPatterns.
HISTORY_IGNORE configuration values containing nested quantifiers or unusually long alternation groups.

Detection Strategies

Inventory Java applications and container images for vulnerable JLine versions (3.0.0 through 3.30.14 and 4.x prior to 4.3.1) using software composition analysis.
Review configuration sources (env vars, dotfiles, deployment manifests) for HISTORY_IGNORE values that contain regex-like constructs beyond simple globs.
Instrument affected JVMs to capture thread dumps when CPU exceeds a defined threshold on the reader thread.

Monitoring Recommendations

Alert on sustained high CPU on interactive Java shell processes, especially those consuming console input via JLine.
Log and audit changes to shell or application configuration files that populate HISTORY_IGNORE.
Track dependency updates in build pipelines to flag transitive pulls of vulnerable JLine artifacts from Maven Central.

How to Mitigate CVE-2026-77420

Immediate Actions Required

Upgrade JLine to version 3.30.15 (3.x branch) or 4.3.1 (4.x branch) across all applications and container images.
Audit the source of HISTORY_IGNORE values and restrict them to trusted administrators only.
Rebuild and redeploy downstream applications that bundle JLine transitively to ensure the fixed version is loaded at runtime.

Patch Information

The fix is available in the JLine3 Release v3.30.15 and JLine3 Release v4.3.1. Technical details are documented in GitHub Security Advisory GHSA-5q95-hrpc-m3w3, with code changes in JLine3 Commit 1d5fc30, JLine3 Commit 341ee69, JLine3 Pull Request #2012, and JLine3 Pull Request #2018.

Workarounds

Unset or hardcode HISTORY_IGNORE to a known-safe literal value until the upgrade is applied.
Prevent untrusted users from writing to configuration files or environment variables that feed JLine settings.
Run interactive JLine shells with CPU cgroup limits so a single stalled reader thread cannot exhaust host resources.

bash

# Enforce a safe HISTORY_IGNORE value and upgrade JLine in a Maven project
export HISTORY_IGNORE="exit:quit:clear"

mvn versions:use-dep-version -Dincludes=org.jline:jline -DdepVersion=3.30.15 -DforceVersion=true
mvn -q dependency:tree | grep org.jline