Executive brief
JLine3 is a popular Java library for building interactive command-line applications. Its built-in grep command is vulnerable to a regular expression denial-of-service (ReDoS) attack. An attacker can supply a maliciously crafted regex pattern that causes the grep command to hang indefinitely, consuming CPU and blocking the thread. In environments where JLine is exposed to remote users, this can degrade service availability or cause application threads to become unresponsive.
Technical details
The vulnerability is a ReDoS flaw in the grep implementation (`org.jline.builtins.PosixCommands.java`). The vulnerable code automatically wraps user-supplied regex patterns with `.*` prefix and suffix before compiling them with Java's standard backtracking regex engine. Patterns like `(a+)+b` combined with the automatic wrapping cause catastrophic backtracking on non-matching input. The attack requires only network access to an application exposing JLine's grep command; no authentication is required. An attacker can occupy worker threads indefinitely and repeat the attack to reduce service availability. The suggested fix is to use a linear-time regex engine (RE2/J) or switch to `Matcher.find()` semantics without automatic wrapping.
Affected products
- JLine jline-builtins 3.x (prior to fix)
Timeline
- 2026-09-23: disclosed