CVE-2026-77420: 
Java vulnerability analysis and mitigation

CVE-2026-77420 is a ReDoS (Regular Expression Denial of Service) vulnerability in JLine3, a Java library for handling console input. The flaw exists in DefaultHistory.matchPatterns() within reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java, where the HISTORY_IGNORE configuration value is converted into a Java regular expression with only partial escaping of regex metacharacters. An attacker who can control application or user configuration can supply a nested-quantifier pattern (e.g., (a+)+b) that causes catastrophic backtracking each time a command is added to history, indefinitely blocking the reader thread at high CPU. Affected versions are JLine3 >= 3.0.0 < 3.30.15 and >= 4.0.0 < 4.3.1. The vulnerability was published on September 23, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is CWE-1333 (Inefficient Regular Expression Complexity). In DefaultHistory.matchPatterns(), the code iterates over the HISTORY_IGNORE string and translates only * (to .*) and : (to |) while passing all other characters — including regex metacharacters such as (, ), +, ?, {, }, [, and ] — directly to the Java regex engine unescaped. This allows a crafted value like (a+)+b to reach Java's backtracking NFA engine, which exhibits exponential worst-case complexity on such nested-quantifier patterns. The attack vector is local (AV:L) with low privileges required (PR:L), meaning the attacker must be able to set the HISTORY_IGNORE environment variable or modify a JLine3 configuration file. The fix applies Pattern.quote() to all non-wildcard, non-separator characters and wraps matching with a SafeRegex utility that enforces a wall-clock deadline via a TimeoutCharSequence wrapper (GitHub Advisory, Fix PR #2012).

Successful exploitation causes a denial-of-service condition by hanging the JLine3 reader thread and consuming excessive CPU resources. The impact is limited to availability (no confidentiality or integrity loss), but the hang is indefinite — the reader thread does not recover without process termination. Any Java application embedding org.jline:jline-reader that allows users or application configuration to set HISTORY_IGNORE is affected, which can render interactive CLI tools completely unresponsive (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the publication date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to control the HISTORY_IGNORE configuration variable or a JLine3 configuration file, limiting the practical attack surface. The vulnerability was identified and responsibly disclosed by Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team (GitHub Advisory).

1. Identify target: Locate a Java application embedding org.jline:jline-reader versions >= 3.0.0 < 3.30.15 or >= 4.0.0 < 4.3.1 that exposes an interactive CLI and allows user-controlled configuration.
2. Gain configuration access: Obtain the ability to set the HISTORY_IGNORE environment variable or modify the JLine3 configuration file (e.g., ~/.jline/config) as a local user with low privileges.
3. Craft malicious pattern: Set HISTORY_IGNORE to a nested-quantifier ReDoS pattern, for example:

   set history-ignore "(a+)+b"

4. Trigger backtracking: At the JLine prompt, enter a long string that does not match the pattern (e.g., aaaaaaaaaaaaaaaaaaaaaaaaaaax) and press Enter. Each command added to history causes matchPatterns() to evaluate the malicious regex against the input.
5. Achieve DoS: The Java regex engine enters catastrophic backtracking, consuming 100% CPU on the reader thread. The prompt does not return, effectively hanging the interactive session (GitHub Advisory).

• Process: Java process consuming sustained high CPU (near 100%) on a single thread associated with a JLine3-based interactive application; the process becomes unresponsive to user input.
• Logs: Application logs may show no activity after a command was entered, with the reader thread stuck; JVM thread dumps would show the reader thread blocked inside java.util.regex matching methods (e.g., Pattern$GroupHead.match, Pattern$Curly.match).
• Configuration Files: Presence of regex metacharacters such as (, ), +, ?, {, } in the HISTORY_IGNORE setting within JLine3 configuration files (e.g., ~/.jline/config) or environment variables, particularly nested quantifier patterns like (a+)+b.

Upgrade org.jline:jline-reader to version 3.30.15 (for the 3.x branch) or 4.3.1 (for the 4.x branch), which apply Pattern.quote() to all non-wildcard characters in HISTORY_IGNORE and introduce a SafeRegex utility with wall-clock timeout enforcement. As a temporary workaround, restrict the ability of non-administrative users to set the HISTORY_IGNORE environment variable or modify JLine3 configuration files, and monitor for unexpected CPU spikes in processes using JLine3. Ensure that HISTORY_IGNORE values are set only by trusted administrators (GitHub Advisory, Fix PR #2012).

The vulnerability was responsibly disclosed by Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team and addressed promptly by JLine3 maintainer gnodet, who merged the fix on June 30, 2026. The fix was broader than the specific CVE, addressing eight locations across the terminal, reader, and builtins modules where user-controlled input was matched as a Java regex without protection. The pull request received automated review from CodeRabbit and Augment Code bots, with minor issues identified and resolved before merge (Fix PR #2012, Backport PR #2018).