CVE-2026-77421

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1.

• CWE-1333

• https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541
• https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae
• https://github.com/jline/jline3/pull/2012
• https://github.com/jline/jline3/pull/2018
• https://github.com/jline/jline3/releases/tag/4.3.1
• https://github.com/jline/jline3/releases/tag/jline-3.30.15
• https://github.com/jline/jline3/security/advisories/GHSA-ph9c-7hw9-vhhw

Published

Sep 23, 2026

Last Modified

Sep 23, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77412RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.9
• CVE-2026-77413JSONata is a JSON query and transformation language. Prior t…9.3
• CVE-2026-77414JSONata is a JSON query and transformation language. Prior t…9.3
• CVE-2026-77415JSONata is a JSON query and transformation language. Prior t…9.3
• CVE-2026-7742A flaw has been found in CodeAstro Online Classroom 1.0. The…6.3
• CVE-2026-77420JLine is a Java library for handling console input. From 3.0…5.5
• CVE-2026-77422JLine is a Java library for handling console input. From 3.0…7.5
• CVE-2026-77423JLine is a Java library for handling console input. From 3.0…7.5
• CVE-2026-77425Unleash is an open-source feature management platform. Prior…4.3
• CVE-2026-77426Unleash is an open-source feature management platform. Prior…7.1
• CVE-2026-7743A vulnerability has been found in CodeAstro Online Classroom…6.3
• CVE-2026-77438Trilium is an open-source hierarchical note-taking applicati…7.5