Denial of Service Vulnerability in JLine Java Library Affecting Shell Sessions
CVE-2026-77422
7.5HIGH
What is CVE-2026-77422?
A vulnerability in the JLine library allows for a potential Denial of Service condition. The built-in grep command in JLine versions 3.0.0 through 3.30.15 and 4.3.1 improperly processes user-controlled regular expressions, leading to excessive CPU consumption during backtracking searches. This can result in the command worker being blocked indefinitely, especially in remote shell sessions. Users are advised to upgrade to the latest versions 3.30.15 or 4.3.1 to mitigate this issue.
Affected Version(s)
jline3 >= 3.0.0, < 3.30.15 < 3.0.0, 3.30.15
jline3 >= 4.0.0, < 4.3.1 < 4.0.0, 4.3.1