CVE-2026-77422: 
Java vulnerability analysis and mitigation

CVE-2026-77422 is a Regular Expression Denial of Service (ReDoS) vulnerability in JLine's built-in grep command, titled "ReDoS in Built-in grep Command Amplified by Automatic .* Wrapping." The flaw affects org.jline:jline-builtins versions 3.0.0 through 3.30.14 and 4.0.0 through 4.3.0. It was disclosed on June 30, 2026, via a GitHub Security Advisory, with CVE assignment and NVD publication following on September 23, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is CWE-1333 (Inefficient Regular Expression Complexity), specifically catastrophic backtracking in Java's NFA-based regex engine. In builtins/src/main/java/org/jline/builtins/PosixCommands.java, the grep() method automatically wraps any user-supplied regular expression with .* as a prefix and suffix (e.g., .*<user_pattern>.*) before compiling it with Pattern.compile() and evaluating it via Matcher.matches(). This wrapping dramatically expands the backtracking search space for nested-quantifier patterns such as (a+)+b evaluated against non-matching input (e.g., a long string of a characters), causing the matching thread to consume excessive CPU and hang indefinitely. The attack vector is network-accessible (AV:N), requires no privileges or user interaction, and is exploitable in any application embedding jline-builtins that exposes the built-in grep command to remote users (GitHub Advisory, Fix PR #2012).

Successful exploitation causes a denial-of-service condition by indefinitely blocking the command worker thread processing the malicious grep request. In applications that expose JLine shell sessions to remote users, an attacker can occupy worker threads across multiple sessions, progressively degrading or eliminating service availability for legitimate users. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue affecting the hosting application's responsiveness (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or exploit kit integration has been reported, and there is no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the advisory includes a straightforward PoC: running grep '(a+)+b' against a file containing a long string of a characters is sufficient to trigger the hang, making exploitation trivially reproducible by any user with access to the JLine shell (GitHub Advisory, Feedly). The vulnerability was identified by Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team (GitHub Advisory).

1. Identify target: Locate an application embedding org.jline:jline-builtins (versions 3.0.0–3.30.14 or 4.0.0–4.3.0) that exposes a JLine interactive shell session to remote users (e.g., via SSH, telnet, or a web-based terminal).
2. Access the shell: Connect to the exposed JLine shell session using whatever authentication mechanism (or lack thereof) the application provides.
3. Prepare input: Create or reference a file containing a long run of repeated characters that will not match the target pattern, e.g., a string of 20+ a characters: printf 'aaaaaaaaaaaaaaaaaaaaaaa\n' > /tmp/testfile.txt.
4. Submit malicious grep pattern: Execute the built-in grep command with a nested-quantifier pattern: grep '(a+)+b' /tmp/testfile.txt. The grep implementation wraps this to .*((a+)+b).* before compiling and matching.
5. Trigger DoS: The Java regex engine enters catastrophic backtracking against the non-matching input, consuming 100% CPU on the worker thread and causing it to hang indefinitely, blocking that session and reducing thread pool capacity for other users.
6. Amplify impact: Repeat the attack across multiple concurrent sessions to exhaust all available worker threads and deny service to all legitimate users (GitHub Advisory, Fix PR #2012).

• Process: Java worker threads stuck at near-100% CPU utilization for extended periods, associated with regex matching operations in PosixCommands.grep(); thread dumps showing threads blocked inside java.util.regex.Pattern or java.util.regex.Matcher methods.
• Logs: Application logs showing grep commands invoked with nested-quantifier patterns such as (a+)+b, (a+)+, ([a-z]+)+, or similar constructs against long non-matching input strings.
• Network: Repeated or sustained connections to the JLine shell endpoint from the same source IP, particularly if followed by application unresponsiveness or thread exhaustion alerts.
• Application Behavior: Sudden degradation or complete unavailability of the JLine shell service; other users unable to obtain shell sessions due to thread pool exhaustion (GitHub Advisory).

Upgrade to the patched versions: 3.30.15 (for the 3.x branch) or 4.3.1 (for the 4.x branch). The fix removes the unsafe .* wrapping in the grep command, switches from Matcher.matches() to Matcher.find() for substring semantics, and introduces a new SafeRegex utility class that wraps regex input in a TimeoutCharSequence enforcing a wall-clock deadline (checked every 1,024 charAt() calls) to prevent indefinite backtracking. The fix also addresses 7 additional regex injection locations across Less, Nano, Commands, DefaultHistory, LineReaderImpl, and AttributedString. If immediate upgrade is not possible, restrict access to the JLine shell to trusted users only, or disable the built-in grep command in the application configuration (GitHub Advisory, Fix PR #2012, Backport PR #2018).

The JLine maintainer (gnodet) responded promptly, merging the fix (PR #2012) on the same day as the advisory disclosure (June 30, 2026) and backporting it to the 3.x branch (PR #2018) the same day. The fix was noted to address four related GHSAs simultaneously (GHSA-r2xf-8xr9-62gw, GHSA-2v9w-34q6-wpqx, GHSA-ph9c-7hw9-vhhw, GHSA-5q95-hrpc-m3w3), indicating a broader audit of regex usage in the codebase. Red Hat tracked the issue via Bugzilla (bug #2539620) and published a CVE advisory, suggesting downstream impact on Red Hat products embedding JLine (GitHub Advisory, Red Hat CVE, Fix PR #2012).