# CVE-2026-77420: JLine HISTORY_IGNORE ReDoS via unescaped regex metacharacters

Source: https://junglewise.ai/threats/cve-2026-77420-jline-history-ignore-redos-via-unescaped-regex-metacharacters  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77420 · Severity: medium · CVSS 5.5 · Published 2026-09-23

JLine is a popular Java library that provides interactive command-line editing features for terminal applications. A denial-of-service vulnerability exists in its history-filtering feature: when an application allows users to configure the HISTORY_IGNORE setting, a crafted pattern containing regex metacharacters can cause the command-line reader to hang at high CPU due to catastrophic regex backtracking. This impacts availability of any interactive session using the affected library.

Technologies: [JLine](https://junglewise.ai/threats/technologies/jline). Vendors: [JLine](https://junglewise.ai/threats/vendors/jline), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-77420 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77420 being exploited in the wild.

**How severe is CVE-2026-77420?** Medium severity, with a CVSS score of 5.5, published 23 September 2026.

**Which products and versions are affected?** JLine 3 (prior to fix); org.jline:jline-reader (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.3.1.

**Is there a fix for CVE-2026-77420?** Yes. org.jline:jline-reader (Maven): upgrade to 4.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77420 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-77420?** Check whether you run JLine or org.jline:jline-reader (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jline:jline-reader (Maven): upgrade to 4.3.1 or later

  ```sh
  # set org.jline:jline-reader to 4.3.1 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in JLine's DefaultHistory.matchPatterns() method. The root cause is incomplete escaping of regex metacharacters in the HISTORY_IGNORE configuration variable: the code translates wildcards (* to .*) and separators (:) but passes through unescaped regex metacharacters such as parentheses, plus signs, question marks, and braces directly to Java's regex engine. An attacker who controls the HISTORY_IGNORE configuration (via config files, environment, or application settings) can supply a crafted pattern like "(a+)+b" that triggers catastrophic backtracking when a non-matching command is entered, hanging the reader thread. The fix is to escape all characters by default using Pattern.quote() and translate only the intended wildcard and separator syntax. Patches are available from the maintainers.

## Affected products

- JLine JLine 3 (prior to fix)

## Identifiers

- CVE-2026-77420
- GHSA-5q95-hrpc-m3w3

## Timeline

- 2026-09-23: disclosed: Vulnerability published via GHSA-5q95-hrpc-m3w3

## Related threats

- [JLine regular expression denial of service in less viewer](https://junglewise.ai/threats/cve-2026-77423-jline-is-a-java-library-for-handling-console-input-from-3-0-0)
- [JLine Nano editor ReDoS in regex search mode](https://junglewise.ai/threats/cve-2026-77421-jline-nano-editor-redos-in-regex-search-mode)
- [JLine JLine3 denial of service in Telnet server NAWS handling](https://junglewise.ai/threats/cve-2026-56741-jline-jline3-denial-of-service-in-telnet-server-naws-handling)
- [JLine JLine3 denial of service in Telnet server NEW-ENVIRON handling](https://junglewise.ai/threats/cve-2026-56740-jline-jline3-denial-of-service-in-telnet-server-new-environ)