Executive brief
JLine is a Java library that provides terminal editing capabilities, including a built-in nano editor for interactive text editing. When regex search mode is enabled in the nano editor, an attacker can supply a specially crafted regular expression pattern that causes the editor to hang and consume high CPU, denying service to the user or (in multi-user deployments) monopolizing a server worker thread.
Technical details
The vulnerability is a regular expression denial-of-service (ReDoS) flaw in the Nano.java search implementation. When regex mode is enabled, user-supplied search terms are compiled directly as Java regular expressions without timeout or backtracking bounds. The vulnerable code path uses Java's standard backtracking-based regex engine, which is susceptible to catastrophic backtracking on nested-quantifier patterns such as (a+)+b. An attacker must enable regex search mode in the editor and supply the malicious pattern; the pattern is then compiled and applied against buffer content. The suggested fix is to replace the Java regex engine with Google's RE2J linear-time engine, or as a fallback, to enforce regex compilation timeouts or reject dangerous constructs.
Affected products
- JLine JLine <UNKNOWN>
Timeline
- 2026-09-23: disclosed
- 2026-09-23: advisory: CVE-2026-77421