JLine up to 3.30.14/4.3.0 Grep Command PosixCommands.java grep resource consumption

Summaryinfo

A vulnerability was found in JLine up to 3.30.14/4.3.0. It has been classified as problematic. The affected element is the function grep of the file builtins/src/main/java/org/jline/builtins/PosixCommands.java of the component Grep Command. The manipulation leads to resource consumption. This vulnerability is referenced as CVE-2026-77422. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in JLine up to 3.30.14/4.3.0. It has been rated as problematic. This issue affects the function grep of the file builtins/src/main/java/org/jline/builtins/PosixCommands.java of the component Grep Command. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-77422 since 08/20/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 3.30.15 or 4.3.1 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• JLine

Version

• 3.30.0
• 3.30.1
• 3.30.2
• 3.30.3
• 3.30.4
• 3.30.5
• 3.30.6
• 3.30.7
• 3.30.8
• 3.30.9
• 3.30.10
• 3.30.11
• 3.30.12
• 3.30.13
• 3.30.14
• 4.0
• 4.1
• 4.2
• 4.3.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion