# CVE-2026-77422: JLine ReDoS in built-in grep command

Source: https://junglewise.ai/threats/cve-2026-77422-jline-redos-in-built-in-grep-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77422 · Severity: high · CVSS 7.5 · Published 2026-09-23

JLine3 is a popular Java library for building interactive command-line applications. Its built-in grep command is vulnerable to a regular expression denial-of-service (ReDoS) attack. An attacker can supply a maliciously crafted regex pattern that causes the grep command to hang indefinitely, consuming CPU and blocking the thread. In environments where JLine is exposed to remote users, this can degrade service availability or cause application threads to become unresponsive.

Vendors: [JLine](https://junglewise.ai/threats/vendors/jline), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-77422 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77422 being exploited in the wild.

**How severe is CVE-2026-77422?** High severity, with a CVSS score of 7.5, published 23 September 2026.

**Which products and versions are affected?** Jline-Builtins 3.x (prior to fix); org.jline:jline-builtins (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.3.1.

**Is there a fix for CVE-2026-77422?** Yes. org.jline:jline-builtins (Maven): upgrade to 4.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77422 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-77422?** Check whether you run Jline-Builtins or org.jline:jline-builtins (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jline:jline-builtins (Maven): upgrade to 4.3.1 or later

  ```sh
  # set org.jline:jline-builtins to 4.3.1 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability is a ReDoS flaw in the grep implementation (`org.jline.builtins.PosixCommands.java`). The vulnerable code automatically wraps user-supplied regex patterns with `.*` prefix and suffix before compiling them with Java's standard backtracking regex engine. Patterns like `(a+)+b` combined with the automatic wrapping cause catastrophic backtracking on non-matching input. The attack requires only network access to an application exposing JLine's grep command; no authentication is required. An attacker can occupy worker threads indefinitely and repeat the attack to reduce service availability. The suggested fix is to use a linear-time regex engine (RE2/J) or switch to `Matcher.find()` semantics without automatic wrapping.

## Affected products

- JLine jline-builtins 3.x (prior to fix)

## Identifiers

- CVE-2026-77422
- GHSA-r2xf-8xr9-62gw

## Timeline

- 2026-09-23: disclosed

## Related threats

- [JLine Nano editor ReDoS in regex search mode](https://junglewise.ai/threats/cve-2026-77421-jline-nano-editor-redos-in-regex-search-mode)