Skip to content
OpenAdvisories
High · 7.5 CVE-2026-77423 EUVD-2026-85531

JLine: ReDoS in Built-in Less Viewer Search

Published Sep 23, 2026 · Updated Sep 24, 2026 · Assigned by GitHub_M

Description

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier expression evaluated against non-matching lines can consume excessive CPU and indefinitely block the session thread, and repeated sessions in Telnet or SSH deployments can exhaust a bounded worker pool. This issue is fixed in versions 3.30.15 and 4.3.1.

Affected products

VendorProductAffectedFixed
jline jline3 >= 3.0.0, < 3.30.15, >= 4.0.0, < 4.3.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 jline3 No fix yet —
Debian 13 jline3 No fix yet —
Debian 12 jline3 No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 jline +2 No fix yet —
Ubuntu 26.04 LTS jline +2 No fix yet —
Ubuntu 24.04 LTS jline +2 No fix yet —
Ubuntu 22.04 LTS jline +2 No fix yet —
Ubuntu 20.04 LTS jline +1 No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS jline +1 No fix yet —
Ubuntu 16.04 LTS jline +1 No fix yet —
Ubuntu 14.04 LTS jline +1 No fix yet —

References