Executive brief
JLine is a popular Java library that provides interactive command-line editing features for terminal applications. A denial-of-service vulnerability exists in its history-filtering feature: when an application allows users to configure the HISTORY_IGNORE setting, a crafted pattern containing regex metacharacters can cause the command-line reader to hang at high CPU due to catastrophic regex backtracking. This impacts availability of any interactive session using the affected library.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in JLine's DefaultHistory.matchPatterns() method. The root cause is incomplete escaping of regex metacharacters in the HISTORY_IGNORE configuration variable: the code translates wildcards (* to .*) and separators (:) but passes through unescaped regex metacharacters such as parentheses, plus signs, question marks, and braces directly to Java's regex engine. An attacker who controls the HISTORY_IGNORE configuration (via config files, environment, or application settings) can supply a crafted pattern like "(a+)+b" that triggers catastrophic backtracking when a non-matching command is entered, hanging the reader thread. The fix is to escape all characters by default using Pattern.quote() and translate only the intended wildcard and separator syntax. Patches are available from the maintainers.
Affected products
- JLine JLine 3 (prior to fix)
Timeline
- 2026-09-23: disclosed: Vulnerability published via GHSA-5q95-hrpc-m3w3