JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jline | jline3 | 3.0.0 to before 3.30.15; 4.0.0 to before 4.3.1 | 3.30.15, 4.3.1 | Patch available | CNA |
| — | org.jline:jline-reader (Maven) | 4.0.0 to before 4.3.1 | 4.3.1 | Patch available | GHSA-5q95-hrpc-m3w3 |
| — | org.jline:jline-reader (Maven) | 3.0.0 to before 3.30.15 | 3.30.15 | Patch available | GHSA-5q95-hrpc-m3w3 |
- jline3 Vendorjline Affected 3.0.0 to before 3.30.15; 4.0.0 to before 4.3.1 Fixed in 3.30.15, 4.3.1 Patch available CNA
- org.jline:jline-reader (Maven) Vendor— Affected 4.0.0 to before 4.3.1 Fixed in 4.3.1 Patch available GHSA-5q95-hrpc-m3w3
- org.jline:jline-reader (Maven) Vendor— Affected 3.0.0 to before 3.30.15 Fixed in 3.30.15 Patch available GHSA-5q95-hrpc-m3w3
Remediation
- Fix · CNA jline3 (jline) Fixed in 3.30.15, 4.3.1
- Fix · GHSA-5q95-hrpc-m3w3 org.jline:jline-reader (Maven) Fixed in 4.3.1 Advisory →
- Fix · GHSA-5q95-hrpc-m3w3 org.jline:jline-reader (Maven) Fixed in 3.30.15 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-77420
- 2026-10-03 Alias added: GHSA-5q95-hrpc-m3w3
References
Other 8
- https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3
- https://github.com/jline/jline3/pull/2012
- https://github.com/jline/jline3/pull/2018
- https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541
- https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae
- https://github.com/jline/jline3/releases/tag/4.3.1
- https://github.com/jline/jline3/releases/tag/jline-3.30.15
- https://github.com/jline/jline3
More jline vulnerabilities
- TI-2026-54009 JLine: ReDoS in Built-in Less Viewer Search CVSS 3.1HIGH 7.5
- TI-2026-54008 JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping CVSS 3.1HIGH 7.5
- TI-2026-40914 JLine: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry CVSS 3.1HIGH 7.5
- TI-2026-40913 JLine: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables CVSS 3.1HIGH 7.5
- TI-2023-27628 An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers… CVSS 3.1MEDIUM 5.5
- TI-2026-54007 JLine: ReDoS in Nano Editor Regex Search Mode CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-77420 · CVE Program
- CVE-2026-77420 · NVD
- FIRST EPSS
- GHSA-5q95-hrpc-m3w3 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-77420 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences