CVE-2026-77423: JLine: ReDoS in Built-in Less Viewer Search
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier expression evaluated against non-matching lines can consume excessive CPU and indefinitely block the session thread, and repeated sessions in Telnet or SSH deployments can exhaust a bounded worker pool. This issue is fixed in versions 3.30.15 and 4.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JLineto a version that resolves this vulnerability.Fixed in 3.30.15 - Upgrade
Upgrade
JLineto a version that resolves this vulnerability.Fixed in 4.3.1
Event History
Frequently Asked Questions
Which deployments are most exposed to service disruption?
Deployments that expose JLine's built-in less viewer through Telnet or SSH are particularly exposed. Repeated malicious sessions can consume the bounded worker pool after each session blocks its thread.
What must an attacker be able to do to trigger the issue?
An attacker needs to supply a search or display-filter pattern to the built-in less viewer. A nested-quantifier regular expression evaluated against non-matching file lines can consume excessive CPU and indefinitely block the session thread.
Are standard JLine versions affected?
The affected range is JLine versions from 3.0.0 up to 3.30.15, as well as version 4.3.1. The issue is fixed in versions 3.30.15 and 4.3.1.