JLine: ReDoS in Built-in Less Viewer Search
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-1333.
Summary
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier expression evaluated against non-matching lines can consume excessive CPU and indefinitely block the session thread, and repeated sessions in Telnet or SSH deployments can exhaust a bounded worker pool. This issue is fixed in versions 3.30.15 and 4.3.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA jline3 (jline) Fixed in 3.30.15, 4.3.1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
Not affected: 1 product
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-10-02 Threatist record created from CVE-2026-77423
References
Other 7
- https://github.com/jline/jline3/security/advisories/GHSA-2v9w-34q6-wpqx
- https://github.com/jline/jline3/pull/2012
- https://github.com/jline/jline3/pull/2018
- https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541
- https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae
- https://github.com/jline/jline3/releases/tag/4.3.1
- https://github.com/jline/jline3/releases/tag/jline-3.30.15
More jline vulnerabilities
- TI-2026-54008 JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping CVSS 3.1HIGH 7.5
- TI-2026-40914 JLine: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry CVSS 3.1HIGH 7.5
- TI-2026-40913 JLine: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables CVSS 3.1HIGH 7.5
- TI-2026-54006 JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable CVSS 3.1MEDIUM 5.5
- TI-2023-27628 An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers… CVSS 3.1MEDIUM 5.5
- TI-2026-54007 JLine: ReDoS in Nano Editor Regex Search Mode CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-77423 · CVE Program
- CVE-2026-77423 · NVD
- FIRST EPSS
- CVE-2026-77423 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences