CVE-2026-77421: JLine Nano editor ReDoS in regex search mode

CVE-2026-77421 · Severity: medium · CVSS 6.5 · Published 2026-09-23

JLine is a Java library that provides terminal editing capabilities, including a built-in nano editor for interactive text editing. When regex search mode is enabled in the nano editor, an attacker can supply a specially crafted regular expression pattern that causes the editor to hang and consume high CPU, denying service to the user or (in multi-user deployments) monopolizing a server worker thread.

Technologies: JLine. Vendors: JLine, Maven.

Quick answers

Is CVE-2026-77421 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77421 being exploited in the wild.
How severe is CVE-2026-77421?
Medium severity, with a CVSS score of 6.5, published 23 September 2026.
Which products and versions are affected?
JLine <UNKNOWN>; org.jline:jline-builtins (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.3.1.
Is there a fix for CVE-2026-77421?
Yes. org.jline:jline-builtins (Maven): upgrade to 4.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77421 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-77421?
Check whether you run JLine or org.jline:jline-builtins (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.jline:jline-builtins (Maven): upgrade to 4.3.1 or later
    # set org.jline:jline-builtins to 4.3.1 in your pom.xml or build.gradle

Technical details

The vulnerability is a regular expression denial-of-service (ReDoS) flaw in the Nano.java search implementation. When regex mode is enabled, user-supplied search terms are compiled directly as Java regular expressions without timeout or backtracking bounds. The vulnerable code path uses Java's standard backtracking-based regex engine, which is susceptible to catastrophic backtracking on nested-quantifier patterns such as (a+)+b. An attacker must enable regex search mode in the editor and supply the malicious pattern; the pattern is then compiled and applied against buffer content. The suggested fix is to replace the Java regex engine with Google's RE2J linear-time engine, or as a fallback, to enforce regex compilation timeouts or reject dangerous constructs.

Affected products

  • JLine JLine <UNKNOWN>

Identifiers

  • CVE-2026-77421
  • GHSA-ph9c-7hw9-vhhw

Timeline

  • 2026-09-23: disclosed
  • 2026-09-23: advisory: CVE-2026-77421

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.