Is CVE-2026-77420 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77420 being exploited in the wild.

How severe is CVE-2026-77420?

Medium severity, with a CVSS score of 5.5, published 23 September 2026.

Which products and versions are affected?

JLine 3 (prior to fix); org.jline:jline-reader (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.3.1.

Is there a fix for CVE-2026-77420?

Yes. org.jline:jline-reader (Maven): upgrade to 4.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77420 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-77420?

Check whether you run JLine or org.jline:jline-reader (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77420: JLine HISTORY_IGNORE ReDoS via unescaped regex metacharacters

CVE-2026-77420 · Severity: medium · CVSS 5.5 · Published 2026-09-23

JLine is a popular Java library that provides interactive command-line editing features for terminal applications. A denial-of-service vulnerability exists in its history-filtering feature: when an application allows users to configure the HISTORY_IGNORE setting, a crafted pattern containing regex metacharacters can cause the command-line reader to hang at high CPU due to catastrophic regex backtracking. This impacts availability of any interactive session using the affected library.

Technologies: JLine. Vendors: JLine, Maven.

Quick answers

Is CVE-2026-77420 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77420 being exploited in the wild.
How severe is CVE-2026-77420?: Medium severity, with a CVSS score of 5.5, published 23 September 2026.
Which products and versions are affected?: JLine 3 (prior to fix); org.jline:jline-reader (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.3.1.
Is there a fix for CVE-2026-77420?: Yes. org.jline:jline-reader (Maven): upgrade to 4.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77420 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-77420?: Check whether you run JLine or org.jline:jline-reader (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.jline:jline-reader (Maven): upgrade to 4.3.1 or later

# set org.jline:jline-reader to 4.3.1 in your pom.xml or build.gradle

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in JLine's DefaultHistory.matchPatterns() method. The root cause is incomplete escaping of regex metacharacters in the HISTORY_IGNORE configuration variable: the code translates wildcards (* to .*) and separators (:) but passes through unescaped regex metacharacters such as parentheses, plus signs, question marks, and braces directly to Java's regex engine. An attacker who controls the HISTORY_IGNORE configuration (via config files, environment, or application settings) can supply a crafted pattern like "(a+)+b" that triggers catastrophic backtracking when a non-matching command is entered, hanging the reader thread. The fix is to escape all characters by default using Pattern.quote() and translate only the intended wildcard and separator syntax. Patches are available from the maintainers.

Affected products

JLine JLine 3 (prior to fix)

Identifiers

CVE-2026-77420
GHSA-5q95-hrpc-m3w3

Timeline

2026-09-23: disclosed: Vulnerability published via GHSA-5q95-hrpc-m3w3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.