CVE-2026-77421: JLine Nano Editor DOS Vulnerability

CVE-2026-77421 Overview

CVE-2026-77421 is a regular expression denial of service (ReDoS) vulnerability in JLine, a Java library for handling console input. The flaw exists in JLine's built-in nano editor. The doSearch(String text) method in builtins/src/main/java/org/jline/builtins/Nano.java passes user-controlled search terms to Java's backtracking regex engine with no timeout and no backtracking bound. An attacker can supply a nested-quantifier pattern that consumes excessive CPU when evaluated against non-matching buffer content, blocking the editor session thread. Affected versions include JLine 3.0.0 through the fixes in 3.30.15 and 4.3.1.

Critical Impact
In remote multi-user deployments, each abusive search consumes a worker thread indefinitely, degrading availability of the host service.

Affected Products

JLine 3.0.0 through 3.30.14
JLine 4.x releases prior to 4.3.1
Applications embedding JLine's builtins module with the nano editor exposed to remote users

Discovery Timeline

2026-09-23 - CVE-2026-77421 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77421

Vulnerability Analysis

The weakness is classified as [CWE-1333] Inefficient Regular Expression Complexity. JLine's nano editor exposes a regex search mode, and the search term is user-controlled. The doSearch routine compiles the pattern with java.util.regex.Pattern and executes it directly against buffer content using the JDK backtracking engine.

Because Java's default regex engine does not enforce execution time limits or step counts, a crafted pattern with nested quantifiers such as (a+)+$ evaluated against a long non-matching input triggers catastrophic backtracking. The matcher enters an exponential state-space walk and pins a CPU core.

The blocked thread is the editor session thread. In interactive shells embedded in servers, such as SSH-accessible administration consoles or Quarkus/Spring Boot developer tooling, this maps directly to a worker thread in the host process. Repeated invocations across sessions can starve the thread pool and cause a full denial of service.

Root Cause

The root cause is unbounded execution of externally supplied regular expressions. Neither a matcher timeout, an alternative non-backtracking engine, nor pattern validation was applied before the fix.

Attack Vector

An authenticated user with access to the nano editor invokes regex search mode and enters a malicious pattern. No elevated privileges are required beyond normal editor access. The vulnerability requires low privileges and no user interaction on the target session.

java

// Illustrative fix diff from the upstream patch: introduce SafeRegex wrapper
 import org.jline.terminal.Terminal;
 import org.jline.utils.AttributedStringBuilder;
 import org.jline.utils.AttributedStyle;
+import org.jline.utils.SafeRegex;
 import org.jline.utils.StyleResolver;

 import static org.jline.builtins.SyntaxHighlighter.*;
// Source: https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541

The upstream patches introduce a SafeRegex utility and route regex evaluation in Commands.java and Less.java through it, guarding against catastrophic backtracking.

Detection Methods for CVE-2026-77421

Indicators of Compromise

Sustained 100% CPU utilization on a single JVM thread tied to a JLine nano or less session
Thread dumps showing threads stuck in java.util.regex.Pattern$Curly.match0 or similar backtracking frames
User sessions that become unresponsive immediately after issuing a regex search containing nested quantifiers

Detection Strategies

Monitor JVM thread CPU time and flag threads exceeding a configured wall-clock budget while executing java.util.regex frames
Enable audit logging on embedded shells to capture search patterns issued through nano and correlate with CPU spikes
Scan dependency manifests (pom.xml, build.gradle) for org.jline:jline-builtins versions below 3.30.15 or 4.3.1

Monitoring Recommendations

Alert on process-level CPU saturation of long-lived JVM services that host JLine
Track worker thread pool exhaustion metrics in application servers embedding JLine
Capture periodic thread dumps during CPU anomalies to confirm regex backtracking as the cause

How to Mitigate CVE-2026-77421

Immediate Actions Required

Upgrade org.jline:jline-builtins and related JLine modules to 3.30.15 (3.x branch) or 4.3.1 (4.x branch)
Inventory applications that expose the JLine nano editor to remote or multi-tenant users and prioritize those hosts
Restrict access to embedded shells to trusted operators until patched builds are deployed

Patch Information

The fix ships in JLine 3.30.15 and 4.3.1. Upstream commits 1d5fc30 and 341ee69 introduce a SafeRegex helper that bounds regex evaluation. See GHSA-ph9c-7hw9-vhhw, PR #2012, and PR #2018 for the full disclosure.

Workarounds

Disable or remove the nano built-in from applications embedding JLine when patching is not immediately possible
Wrap regex evaluation in a bounded executor and cancel matches exceeding a fixed wall-clock budget
Reject search patterns containing nested quantifier constructs such as (x+)+, (x*)*, or (x|y)+ at the application layer

bash

# Maven dependency override to enforce the patched JLine build
mvn dependency:tree | grep jline
mvn versions:use-dep-version -Dincludes=org.jline:jline-builtins -DdepVersion=3.30.15 -DforceVersion=true