Java Library Vulnerability in JLine Affecting Versions up to 3.30.15 and 4.3.1
CVE-2026-77420
What is CVE-2026-77420?
A vulnerability exists in JLine, a popular Java library for handling console input. The issue arises from the way the library processes the HISTORY_IGNORE configuration value in the method DefaultHistory.matchPatterns. This method incorrectly converts the configuration value into a Java regular expression, escaping only part of its syntax. As a result, attackers who control application or user settings can create nested-quantifier regex expressions. This leads to excessive CPU consumption, potentially blocking the reader thread indefinitely as it reevaluates the command history. To mitigate this issue, it is essential to update to versions 3.30.15 or 4.3.1, where the vulnerability has been addressed.
Affected Version(s)
jline3 >= 3.0.0, < 3.30.15 < 3.0.0, 3.30.15
jline3 >= 4.0.0, < 4.3.1 < 4.0.0, 4.3.1