Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-77421 medium CVSS 6.5

Vulnerability in org.jline:jline-builtins (CVE-2026-77421)

Summary

Vulnerability in org.jline:jline-builtins (CVE-2026-77421). Risk of unauthorized operations or information disclosure. Exploitable via nano. Mitigation: upgrade to 3.30.15 or later.

Original description

The description as published by the source.

Summary

When regex search mode is enabled in the JLine3 nano editor, the user-supplied
search term is compiled directly as a Java regular expression with no timeout or
backtracking bound. A crafted pattern such as (a+)+b can hang the editor session
thread at high CPU, causing a denial of service for that session.

Details

In builtins/src/main/java/org/jline/builtins/Nano.java, the search implementation
uses Pattern.LITERAL only when regex mode is disabled. When regex mode is enabled,
the search term is compiled as a raw Java regex:

Pattern pat = Pattern.compile(
        searchTerm,
        (searchCaseSensitive ? 0 : Pattern.CASE_INSENSITIVE | Pattern.UNICODE_CASE)
                | (searchRegexp ? 0 : Pattern.LITERAL));

This regex is then applied to buffer content. Because Java's regex engine is
backtracking-based, nested-quantifier patterns can take exponential time on
non-matching input.

Affected source location:

  • builtins/src/main/java/org/jline/builtins/Nano.java
  • doSearch(String text)

PoC

  1. Create a file containing a long run of a characters and open it in the JLine3
    nano editor.
  2. Enable regex search mode with the editor's regex toggle.
  3. Start a search and enter the pattern (a+)+b.

Expected result:

  • The editor stops responding.
  • The session thread consumes high CPU.

Reproduction environment:

  • JLine3 on x86_64 Linux
  • OpenJDK 25.0.2

Impact

This is a denial-of-service vulnerability caused by catastrophic…

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-77421 has been found in org.jline:jline-builtins.
Attackers can target a specific entry point like nano over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 6.5/10.
What to do: upgrade org.jline:jline-builtins to 3.30.15 or later.
If unsure, ask your IT team or search "org.jline:jline-builtins CVE-2026-77421" on the vendor's site.

CVE-2026-77421 (org.jline:jline-builtins) — CWE-1333 / CVSS v3 6.5
Attack vector: remote (network-reachable) / no user interaction
Attack surface: nano / Pattern.LITERAL
Patched: 3.30.15 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-1333) exists in org.jline:jline-builtins. Attackers reach the vulnerable code path via nano.

📍 Affected scope

Check the vendor advisory for the affected versions of org.jline:jline-builtins. Attack surface: nano / Pattern.LITERAL.

🔥 Severity

Severity: Medium (CVSS 6.5/10). Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 3.30.15.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    Audit SBOM/dependencies for affected components.

    資産台帳・SBOM・依存マニフェストで org.jline:jline-builtins を使っているサービスとバージョンを洗い出す。

  2. 2
    Apply patch patch 
    Upgrade org.jline:jline-builtins to 3.30.15

    ステージング環境で 3.30.15 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

maven org.jline:jline-builtins
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.15"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details