CVE-2026-77423

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier expression evaluated against non-matching lines can consume excessive CPU and indefinitely block the session thread, and repeated sessions in Telnet or SSH deployments can exhaust a bounded worker pool. This issue is fixed in versions 3.30.15 and 4.3.1.

• CWE-1333

• https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541
• https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae
• https://github.com/jline/jline3/pull/2012
• https://github.com/jline/jline3/pull/2018
• https://github.com/jline/jline3/releases/tag/4.3.1
• https://github.com/jline/jline3/releases/tag/jline-3.30.15
• https://github.com/jline/jline3/security/advisories/GHSA-2v9w-34q6-wpqx

Published

Sep 23, 2026

Last Modified

Sep 23, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77414JSONata is a JSON query and transformation language. Prior t…9.3
• CVE-2026-77415JSONata is a JSON query and transformation language. Prior t…9.3
• CVE-2026-7742A flaw has been found in CodeAstro Online Classroom 1.0. The…6.3
• CVE-2026-77420JLine is a Java library for handling console input. From 3.0…5.5
• CVE-2026-77421JLine is a Java library for handling console input. From 3.0…6.5
• CVE-2026-77422JLine is a Java library for handling console input. From 3.0…7.5
• CVE-2026-77425Unleash is an open-source feature management platform. Prior…4.3
• CVE-2026-77426Unleash is an open-source feature management platform. Prior…7.1
• CVE-2026-7743A vulnerability has been found in CodeAstro Online Classroom…6.3
• CVE-2026-77438Trilium is an open-source hierarchical note-taking applicati…7.5
• CVE-2026-7744A vulnerability was found in CodeAstro Online Classroom 1.0.…6.3
• CVE-2026-7745A vulnerability was determined in CodeAstro Online Classroom…6.3