CVE-2026-77420

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77420", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-20T19:59:59.603Z", "datePublished": "2026-09-23T18:11:25.998Z", "dateUpdated": "2026-09-29T02:05:26.410Z"}, "containers": {"cna": {"title": "JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable", "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3"}, {"name": "https://github.com/jline/jline3/pull/2012", "tags": ["x_refsource_MISC"], "url": "https://github.com/jline/jline3/pull/2012"}, {"name": "https://github.com/jline/jline3/pull/2018", "tags": ["x_refsource_MISC"], "url": "https://github.com/jline/jline3/pull/2018"}, {"name": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541", "tags": ["x_refsource_MISC"], "url": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541"}, {"name": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae", "tags": ["x_refsource_MISC"], "url": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae"}, {"name": "https://github.com/jline/jline3/releases/tag/4.3.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/jline/jline3/releases/tag/4.3.1"}, {"name": "https://github.com/jline/jline3/releases/tag/jline-3.30.15", "tags": ["x_refsource_MISC"], "url": "https://github.com/jline/jline3/releases/tag/jline-3.30.15"}], "affected": [{"vendor": "jline", "product": "jline3", "versions": [{"version": ">= 3.0.0, < 3.30.15", "status": "affected"}, {"version": ">= 4.0.0, < 4.3.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-23T18:11:25.998Z"}, "descriptions": [{"lang": "en", "value": "JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1."}], "source": {"advisory": "GHSA-5q95-hrpc-m3w3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-29T02:05:00.790615Z", "id": "CVE-2026-77420", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T02:05:26.410Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77420", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-29T02:05:00.790615Z"}}}], "references": [{"url": "https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-29T02:05:20.786Z"}}], "cna": {"title": "JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable", "source": {"advisory": "GHSA-5q95-hrpc-m3w3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "jline", "product": "jline3", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.30.15"}, {"status": "affected", "version": ">= 4.0.0, < 4.3.1"}]}], "references": [{"url": "https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3", "name": "https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/jline/jline3/pull/2012", "name": "https://github.com/jline/jline3/pull/2012", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jline/jline3/pull/2018", "name": "https://github.com/jline/jline3/pull/2018", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541", "name": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae", "name": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jline/jline3/releases/tag/4.3.1", "name": "https://github.com/jline/jline3/releases/tag/4.3.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jline/jline3/releases/tag/jline-3.30.15", "name": "https://github.com/jline/jline3/releases/tag/jline-3.30.15", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-23T18:11:25.998Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77420", "state": "PUBLISHED", "dateUpdated": "2026-09-29T02:05:26.410Z", "dateReserved": "2026-08-20T19:59:59.603Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-23T18:11:25.998Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "jline3", "vendor": "jline", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.30.15"}, {"status": "affected", "version": ">= 4.0.0, < 4.3.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1."}], "id": "CVE-2026-77420", "lastModified": "2026-09-30T19:38:27.293", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77420", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-29T02:05:00.790615Z", "version": "2.0.3"}}]}, "published": "2026-09-23T19:19:15.510", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541"}, {"source": "security-advisories@github.com", "url": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae"}, {"source": "security-advisories@github.com", "url": "https://github.com/jline/jline3/pull/2012"}, {"source": "security-advisories@github.com", "url": "https://github.com/jline/jline3/pull/2018"}, {"source": "security-advisories@github.com", "url": "https://github.com/jline/jline3/releases/tag/4.3.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/jline/jline3/releases/tag/jline-3.30.15"}, {"source": "security-advisories@github.com", "url": "https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "org.jline/jline-reader: JLine: Denial of Service vulnerability in history configuration processing", "id": "2539624", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539624"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1333", "details": ["A flaw was found in JLine, a Java library for handling console input. An attacker who can control application or user configuration can supply a specially crafted regular expression to the `HISTORY_IGNORE` configuration variable. This malicious input can cause excessive CPU consumption when commands are added to history, leading to a Denial of Service (DoS) by indefinitely blocking the reader thread."], "mitigation": {"lang": "en:us", "value": "If application configuration allows user-supplied values to flow into HISTORY_IGNORE, validate or sanitize those values to reject regular expression metacharacters (e.g., nested quantifiers such as (a+)+) before they reach JLine's history processing."}, "name": "CVE-2026-77420", "package_state": [{"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Fix deferred", "package_name": "jline-reader", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "jline-reader", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-spark-operator-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-cpu-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th-torch-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-th-torch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "opendaylight", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}], "public_date": "2026-09-23T18:11:25Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-77420\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-77420\nhttps://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541\nhttps://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae\nhttps://github.com/jline/jline3/pull/2012\nhttps://github.com/jline/jline3/pull/2018\nhttps://github.com/jline/jline3/releases/tag/4.3.1\nhttps://github.com/jline/jline3/releases/tag/jline-3.30.15\nhttps://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3"], "statement": "This vulnerability requires local access to modify the JLine HISTORY_IGNORE configuration variable. An attacker must be able to control application or user-level configuration in order to inject a malicious regular expression. There is no impact on data confidentiality or integrity, and the DoS is confined to the application's console input processing, it does not affect the broader system or network.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.30.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.3.1)"}}], "enrichment": {"confidence": 96.0, "confidence_source": "matching", "scores": [{"score": 96.0, "source": "matching"}]}, "original": {"product": "jline3", "source": "cna", "vendor": "jline"}, "product": "jline", "vendor": "jline"}], "created": "2026-09-23T20:45:09.998499+00:00", "updated": "2026-09-27T11:45:48.942802+00:00", "vendors": ["jline", "jline$PRODUCT$jline"]}