CVE-2026-77423

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77423
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77423.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77423
Aliases
  • GHSA-2v9w-34q6-wpqx
Downstream
Published
2026-09-23T18:17:49Z
Modified
2026-09-24T08:34:23Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
JLine: ReDoS in Built-in Less Viewer Search
Details

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier expression evaluated against non-matching lines can consume excessive CPU and indefinitely block the session thread, and repeated sessions in Telnet or SSH deployments can exhaust a bounded worker pool. This issue is fixed in versions 3.30.15 and 4.3.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1333"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77423.json"
}
References

Affected packages

Git / github.com/jline/jline3

Affected ranges

Type
GIT
Repo
https://github.com/jline/jline3
Events
Introduced
cc36cb24e2d5aedc5c25476448e6841dde01d50f
Fixed
b880666cb543c2dc31054ff2203ce5f84190867b
Introduced
e2422d778d98d935edd3d250a0d32b75a802c142
Fixed
6b83c24b6c3900f1c85d113dbeff23280e024f04
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "3.0.0"
        },
        {
            "fixed":  "3.30.15"
        },
        {
            "introduced":  "4.0.0"
        },
        {
            "fixed":  "4.3.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

4.*
4.0.0
4.0.0-SNAPSHOT
4.0.1
4.0.10
4.0.11
4.0.12
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.0-SNAPSHOT
4.1.1
4.1.2
4.1.3
4.2.0
4.2.1
4.3.0
jline-3.*
jline-3.0.0
jline-3.0.1
jline-3.1.0
jline-3.1.1
jline-3.27.0
jline-3.27.1
jline-3.28.0
jline-3.29.0
jline-3.3.1
jline-3.30.0
jline-3.30.1
jline-3.30.10
jline-3.30.11
jline-3.30.12
jline-3.30.13
jline-3.30.14
jline-3.30.2
jline-3.30.3
jline-3.30.4
jline-3.30.5
jline-3.30.6
jline-3.30.7
jline-3.30.8
jline-3.30.9
jline-parent-3.*
jline-parent-3.10.0
jline-parent-3.11.0
jline-parent-3.12.0
jline-parent-3.12.1
jline-parent-3.13.0
jline-parent-3.13.1
jline-parent-3.13.2
jline-parent-3.13.3
jline-parent-3.14.0
jline-parent-3.14.1
jline-parent-3.16.0
jline-parent-3.17.0
jline-parent-3.17.1
jline-parent-3.18.0
jline-parent-3.19.0
jline-parent-3.2.0
jline-parent-3.20.0
jline-parent-3.21.0
jline-parent-3.22.0
jline-parent-3.23.0
jline-parent-3.24.0
jline-parent-3.24.1
jline-parent-3.25.0
jline-parent-3.25.1
jline-parent-3.26.0
jline-parent-3.26.1
jline-parent-3.26.2
jline-parent-3.26.3
jline-parent-3.3.0
jline-parent-3.4.0
jline-parent-3.5.0
jline-parent-3.5.1
jline-parent-3.5.2
jline-parent-3.6.0
jline-parent-3.6.1
jline-parent-3.6.2
jline-parent-3.7.0
jline-parent-3.7.1
jline-parent-3.8.0
jline-parent-3.8.1
jline-parent-3.8.2
jline-parent-3.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77423.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "46470731455920273270260990044807756307",
                "220503831867508928016256418847948763312",
                "152092419726914094848241000474797983761",
                "299752285509533324555188884716457030190"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-77423-ea59a3eb",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/jline/jline3/commit/6b83c24b6c3900f1c85d113dbeff23280e024f04",
        "target":  {
            "file":  "shell/src/main/java/org/jline/shell/ExitShellException.java"
        }
    }
]
vanir_signatures_modified 
"2026-09-24T08:34:23Z"