Java Library JLine Vulnerability in Console Input Handling
CVE-2026-77423
What is CVE-2026-77423?
The JLine library, which facilitates console input in Java applications, contains a vulnerability in its built-in less viewer. The issue arises in versions 3.0.0 through 3.30.15 and 4.3.1 where it directly processes user-controlled regular expression patterns. This can lead to excessive CPU utilization when nested-quantifier expressions are evaluated against non-matching lines, effectively causing an indefinite block of the session thread. In environments using Telnet or SSH, repeated sessions may exhaust the worker pool, leading to denial of service. This flaw requires immediate attention, particularly in deployments utilizing the affected versions, with fixes available in JLine versions 3.30.15 and 4.3.1.
Affected Version(s)
jline3 >= 3.0.0, < 3.30.15 < 3.0.0, 3.30.15
jline3 >= 4.0.0, < 4.3.1 < 4.0.0, 4.3.1