JLine Library Vulnerability in Java Console Input Handling
CVE-2026-77421
What is CVE-2026-77421?
The JLine library, essential for managing console input in Java applications, has a vulnerability found in its nano editor's regex search mode. Specific versions from 3.0.0 up to 3.30.15 and 4.3.1 are affected as they allow a user-controlled search term to be processed without appropriate restrictions on backtracking. This oversight can lead to a scenario where nested-quantifier expressions are evaluated against non-matching content, potentially exhausting CPU resources. In remote deployments with multiple users, this may result in several blocked worker threads, degrading overall application performance. Users are encouraged to upgrade to the latest versions (3.30.15 or 4.3.1) to mitigate this issue.
Affected Version(s)
jline3 >= 3.0.0, < 3.30.15 < 3.0.0, 3.30.15
jline3 >= 4.0.0, < 4.3.1 < 4.0.0, 4.3.1