Skip to content
OpenAdvisories

Description

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.

Affected products

VendorProductAffectedFixed
jline jline3 >= 3.0.0, < 3.30.15, >= 4.0.0, < 4.3.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 jline3 No fix yet —
Debian 13 jline3 No fix yet —
Debian 12 jline3 No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 jline +2 No fix yet —
Ubuntu 26.04 LTS jline +2 No fix yet —
Ubuntu 24.04 LTS jline +2 No fix yet —
Ubuntu 22.04 LTS jline +2 No fix yet —
Ubuntu 20.04 LTS jline +1 No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS jline +1 No fix yet —
Ubuntu 16.04 LTS jline +1 No fix yet —
Ubuntu 14.04 LTS jline +1 No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling akhq 0.28.0-r9 —
Wolfi rolling apache-pulsar-4.2 4.2.4-r6 —
Wolfi rolling celeborn-0.6 No fix yet —
Wolfi rolling druid 37.0.0-r60 —
Wolfi rolling kafka-4.1 4.1.2-r9 —
Wolfi rolling kafka-4.2 4.2.1-r8 —
Wolfi rolling opensearch-3-ml-commons 3.8.0-r4 —
Wolfi rolling spark-4.0-scala-2.13 4.0.4-r6 —
Wolfi rolling spark-4.1-scala-2.13 4.1.3-r5 —
Wolfi rolling tez 0.10.5-r38 —
Wolfi rolling zookeeper-3.9 3.9.6-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jline:jline-builtins >= 4.0.0, < 4.3.1 4.3.1 GHSA-r2xf-8xr9-62gw
Maven org.jline:jline-builtins >= 3.0.0, < 3.30.15 3.30.15 GHSA-r2xf-8xr9-62gw

References