{"id":"CVE-2026-77423","summary":"JLine: ReDoS in Built-in Less Viewer Search","details":"JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier expression evaluated against non-matching lines can consume excessive CPU and indefinitely block the session thread, and repeated sessions in Telnet or SSH deployments can exhaust a bounded worker pool. This issue is fixed in versions 3.30.15 and 4.3.1.","aliases":["GHSA-2v9w-34q6-wpqx"],"modified":"2026-09-24T08:34:23.894466Z","published":"2026-09-23T18:17:49.635Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-1333"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77423.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77423.json"},{"type":"FIX","url":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541"},{"type":"FIX","url":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae"},{"type":"FIX","url":"https://github.com/jline/jline3/pull/2012"},{"type":"FIX","url":"https://github.com/jline/jline3/pull/2018"},{"type":"WEB","url":"https://github.com/jline/jline3/releases/tag/4.3.1"},{"type":"WEB","url":"https://github.com/jline/jline3/releases/tag/jline-3.30.15"},{"type":"ADVISORY","url":"https://github.com/jline/jline3/security/advisories/GHSA-2v9w-34q6-wpqx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77423"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jline/jline3","events":[{"introduced":"cc36cb24e2d5aedc5c25476448e6841dde01d50f"},{"fixed":"b880666cb543c2dc31054ff2203ce5f84190867b"},{"introduced":"e2422d778d98d935edd3d250a0d32b75a802c142"},{"fixed":"6b83c24b6c3900f1c85d113dbeff23280e024f04"}],"database_specific":{"extracted_events":[{"introduced":"3.0.0"},{"fixed":"3.30.15"},{"introduced":"4.0.0"},{"fixed":"4.3.1"}],"source":"AFFECTED_FIELD"}}],"versions":["4.3.0","jline-3.30.14","4.2.1","4.2.0","4.1.3","4.1.2","4.1.1","4.1.0","jline-3.30.13","jline-3.30.12","jline-3.30.11","jline-3.30.10","4.0.12","4.1.0-SNAPSHOT","4.0.11","4.0.10","4.0.9","4.0.8","4.0.7","jline-3.30.9","4.0.6","4.0.5","4.0.4","4.0.3","4.0.2","4.0.1","jline-3.30.8","4.0.0","jline-3.30.7","jline-3.30.6","jline-3.30.5","4.0.0-SNAPSHOT","jline-3.30.4","jline-3.30.3","jline-3.30.2","jline-3.30.1","jline-3.30.0","jline-3.29.0","jline-3.28.0","jline-3.27.1","jline-3.27.0","jline-parent-3.26.3","jline-parent-3.26.2","jline-parent-3.26.1","jline-parent-3.26.0","jline-parent-3.25.1","jline-parent-3.25.0","jline-parent-3.24.1","jline-parent-3.24.0","jline-parent-3.23.0","jline-parent-3.22.0","jline-parent-3.21.0","jline-parent-3.20.0","jline-parent-3.19.0","jline-parent-3.18.0","jline-parent-3.17.1","jline-parent-3.17.0","jline-parent-3.16.0","jline-parent-3.14.1","jline-parent-3.14.0","jline-parent-3.13.3","jline-parent-3.13.2","jline-parent-3.13.1","jline-parent-3.13.0","jline-parent-3.12.1","jline-parent-3.12.0","jline-parent-3.11.0","jline-parent-3.10.0","jline-parent-3.9.0","jline-parent-3.8.2","jline-parent-3.8.1","jline-parent-3.8.0","jline-parent-3.7.1","jline-parent-3.7.0","jline-parent-3.6.2","jline-parent-3.6.1","jline-parent-3.6.0","jline-parent-3.5.2","jline-parent-3.5.1","jline-parent-3.5.0","jline-parent-3.4.0","jline-3.3.1","jline-parent-3.3.0","jline-parent-3.2.0","jline-3.1.1","jline-3.1.0","jline-3.0.1","jline-3.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77423.json","vanir_signatures_modified":"2026-09-24T08:34:23Z","vanir_signatures":[{"target":{"file":"shell/src/main/java/org/jline/shell/ExitShellException.java"},"deprecated":false,"digest":{"line_hashes":["46470731455920273270260990044807756307","220503831867508928016256418847948763312","152092419726914094848241000474797983761","299752285509533324555188884716457030190"],"threshold":0.9},"id":"CVE-2026-77423-ea59a3eb","signature_type":"Line","signature_version":"v1","source":"https://github.com/jline/jline3/commit/6b83c24b6c3900f1c85d113dbeff23280e024f04"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}