CVE-2026-77422highCWE-1333

CVE-2026-77422: falha de alta gravidade em jline3

JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar jline3+ Monitorar jline3

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.6%
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
jline · jline3
CVEs relacionadas — jline3

No mesmo produto, das mais perigosas para as menos.

CVE-2026-56741HIGHJLine: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal GeometryEPSS 0.6%CVE-2026-56740HIGHJLine: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON VariablesEPSS 0.6%CVE-2026-77423HIGHJLine: ReDoS in Built-in Less Viewer SearchEPSS 0.5%CVE-2026-77421MEDIUMJLine: ReDoS in Nano Editor Regex Search ModeEPSS 0.4%CVE-2026-77420MEDIUMJLine: ReDoS via `HISTORY_IGNORE` Configuration VariableEPSS 0.2%