CVE-2026-77423: JLine Java Library DOS Vulnerability

CVE-2026-77423 Overview

CVE-2026-77423 is a regular expression denial of service (ReDoS) vulnerability in JLine, a Java library for handling console input. The flaw affects the built-in less viewer in versions from 3.0.0 up to (but not including) 3.30.15 and 4.3.1. User-controlled search and display-filter patterns retrieved by getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins/Less.java are passed directly to Java's backtracking regex engine and re-evaluated against file content. A crafted nested-quantifier pattern can indefinitely block the session thread and, in Telnet or SSH deployments, exhaust bounded worker pools.

Critical Impact
A single malicious regex submitted through the JLine less viewer can hang session threads and drain server-side worker pools, denying service to legitimate console users.

Affected Products

JLine 3.x from 3.0.0 up to (not including) 3.30.15
JLine 4.x up to (not including) 4.3.1
Applications embedding the JLine builtins module less viewer over Telnet or SSH

Discovery Timeline

2026-09-23 - CVE-2026-77423 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77423

Vulnerability Analysis

The vulnerability is an algorithmic complexity flaw classified as [CWE-1333] Inefficient Regular Expression Complexity. Java's java.util.regex engine uses non-deterministic finite automata with backtracking. When a pattern contains nested quantifiers such as (a+)+, matching against a long non-matching input string grows exponentially with input length.

The JLine less viewer accepts search and display-filter expressions interactively from the terminal session. It forwards them, unchecked, to Pattern.compile and repeatedly applies the compiled pattern across every buffered line during scroll and highlight operations. Because a single line miss can trigger runaway backtracking, one crafted pattern is enough to peg a CPU core.

In multi-tenant Telnet or SSH deployments, each JLine session typically runs on a worker thread from a bounded pool. Repeatedly opening sessions and submitting the same pattern exhausts that pool, denying service to legitimate users while consuming CPU indefinitely.

Root Cause

The root cause is missing input validation and the absence of a bounded matcher around user-supplied regular expressions. The getPattern(boolean doDisplayPattern) method in Less.java returned patterns that were compiled and executed against file content without complexity limits, timeout, or safe-matching wrapper.

Attack Vector

Exploitation requires network access to a service that exposes the JLine less viewer, typically an SSH or Telnet console. No authentication requirement is defined by the vulnerable component itself; whether authentication is needed depends on the embedding application. The attacker enters a pattern such as (a+)+$ into the less search prompt while viewing a sufficiently long file that does not match, then triggers matcher execution.

java

// Patch: import SafeRegex wrapper in Less.java and Commands.java
 import org.jline.utils.Display;
 import org.jline.utils.InfoCmp.Capability;
 import org.jline.utils.NonBlockingReader;
+import org.jline.utils.SafeRegex;
 import org.jline.utils.Status;

 import static org.jline.builtins.SyntaxHighlighter.*;

Source: JLine3 Commit 1d5fc30 and JLine3 Commit 341ee69. The fix introduces a SafeRegex utility that guards matching against catastrophic backtracking.

Detection Methods for CVE-2026-77423

Indicators of Compromise

Sustained 100% CPU usage on JVM threads that host JLine less sessions.
Worker-pool saturation events or thread-pool queue growth on servers exposing SSH or Telnet consoles built on JLine.
Session logs showing repeated less invocations from the same source followed by unresponsive session timeouts.

Detection Strategies

Enumerate application dependencies for org.jline:jline and org.jline:jline-builtins at versions below 3.30.15 or 4.3.1 using software composition analysis.
Capture JVM thread dumps during CPU spikes and look for stack frames in java.util.regex.Pattern$Curly.match0 or Matcher.match originating from org.jline.builtins.Less.
Alert on abnormal duration of JLine session threads compared to historical baselines.

Monitoring Recommendations

Track SSH and Telnet session concurrency and per-session CPU time on hosts that embed JLine.
Ingest JVM metrics such as ThreadPoolExecutor active count, queue size, and rejected task counts into a centralized logging platform.
Monitor for repeated short-lived sessions from the same source IP that transition to long-running high-CPU threads.

How to Mitigate CVE-2026-77423

Immediate Actions Required

Upgrade JLine to version 3.30.15 (3.x branch) or 4.3.1 (4.x branch) as published in the JLine3 3.30.15 release and JLine3 4.3.1 release.
Inventory all internal services that expose a JLine-backed console over SSH or Telnet, including custom admin shells and CLI tools.
Restrict network access to affected consoles to trusted management networks until patching completes.

Patch Information

The fix is delivered in commits 1d5fc30 and 341ee69, referenced by Pull Request #2012 and Pull Request #2018. Both patches route regex matching in Less.java and Commands.java through a new org.jline.utils.SafeRegex helper that constrains backtracking. Full advisory details are in GHSA-2v9w-34q6-wpqx.

Workarounds

Disable or remove the built-in less viewer from applications that embed JLine when upgrading is not immediately feasible.
Wrap user-supplied regex inputs in a bounded matcher that enforces execution timeouts before passing them to Pattern.compile and Matcher.find.
Cap the size of files browseable through the less viewer to reduce the number of lines evaluated per pattern.

bash

# Update JLine coordinates in Maven pom.xml
<dependency>
  <groupId>org.jline</groupId>
  <artifactId>jline</artifactId>
  <version>3.30.15</version>
</dependency>

# Or, for the 4.x branch
<dependency>
  <groupId>org.jline</groupId>
  <artifactId>jline</artifactId>
  <version>4.3.1</version>
</dependency>