CVE-2026-77422

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.

• CWE-1333

• https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541
• https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae
• https://github.com/jline/jline3/pull/2012
• https://github.com/jline/jline3/pull/2018
• https://github.com/jline/jline3/releases/tag/4.3.1
• https://github.com/jline/jline3/releases/tag/jline-3.30.15
• https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw

Published

Sep 23, 2026

Last Modified

Sep 23, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77413JSONata is a JSON query and transformation language. Prior t…9.3
• CVE-2026-77414JSONata is a JSON query and transformation language. Prior t…9.3
• CVE-2026-77415JSONata is a JSON query and transformation language. Prior t…9.3
• CVE-2026-7742A flaw has been found in CodeAstro Online Classroom 1.0. The…6.3
• CVE-2026-77420JLine is a Java library for handling console input. From 3.0…5.5
• CVE-2026-77421JLine is a Java library for handling console input. From 3.0…6.5
• CVE-2026-77423JLine is a Java library for handling console input. From 3.0…7.5
• CVE-2026-77425Unleash is an open-source feature management platform. Prior…4.3
• CVE-2026-77426Unleash is an open-source feature management platform. Prior…7.1
• CVE-2026-7743A vulnerability has been found in CodeAstro Online Classroom…6.3
• CVE-2026-77438Trilium is an open-source hierarchical note-taking applicati…7.5
• CVE-2026-7744A vulnerability was found in CodeAstro Online Classroom 1.0.…6.3