CVE-2026-77422

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77422", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-20T19:59:59.603Z", "datePublished": "2026-09-23T18:09:32.308Z", "dateUpdated": "2026-09-24T14:13:39.588Z"}, "containers": {"cna": {"title": "JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping", "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw"}, {"name": "https://github.com/jline/jline3/pull/2012", "tags": ["x_refsource_MISC"], "url": "https://github.com/jline/jline3/pull/2012"}, {"name": "https://github.com/jline/jline3/pull/2018", "tags": ["x_refsource_MISC"], "url": "https://github.com/jline/jline3/pull/2018"}, {"name": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541", "tags": ["x_refsource_MISC"], "url": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541"}, {"name": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae", "tags": ["x_refsource_MISC"], "url": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae"}, {"name": "https://github.com/jline/jline3/releases/tag/4.3.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/jline/jline3/releases/tag/4.3.1"}, {"name": "https://github.com/jline/jline3/releases/tag/jline-3.30.15", "tags": ["x_refsource_MISC"], "url": "https://github.com/jline/jline3/releases/tag/jline-3.30.15"}], "affected": [{"vendor": "jline", "product": "jline3", "versions": [{"version": ">= 3.0.0, < 3.30.15", "status": "affected"}, {"version": ">= 4.0.0, < 4.3.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-23T18:09:32.308Z"}, "descriptions": [{"lang": "en", "value": "JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1."}], "source": {"advisory": "GHSA-r2xf-8xr9-62gw", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-24T14:13:32.954382Z", "id": "CVE-2026-77422", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-24T14:13:39.588Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77422", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-24T14:13:32.954382Z"}}}], "references": [{"url": "https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-24T14:13:17.899Z"}}], "cna": {"title": "JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping", "source": {"advisory": "GHSA-r2xf-8xr9-62gw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "jline", "product": "jline3", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.30.15"}, {"status": "affected", "version": ">= 4.0.0, < 4.3.1"}]}], "references": [{"url": "https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw", "name": "https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/jline/jline3/pull/2012", "name": "https://github.com/jline/jline3/pull/2012", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jline/jline3/pull/2018", "name": "https://github.com/jline/jline3/pull/2018", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541", "name": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae", "name": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jline/jline3/releases/tag/4.3.1", "name": "https://github.com/jline/jline3/releases/tag/4.3.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/jline/jline3/releases/tag/jline-3.30.15", "name": "https://github.com/jline/jline3/releases/tag/jline-3.30.15", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-23T18:09:32.308Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77422", "state": "PUBLISHED", "dateUpdated": "2026-09-24T14:13:39.588Z", "dateReserved": "2026-08-20T19:59:59.603Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-23T18:09:32.308Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "jline3", "vendor": "jline", "versions": [{"status": "affected", "version": ">= 3.0.0, < 3.30.15"}, {"status": "affected", "version": ">= 4.0.0, < 4.3.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1."}], "id": "CVE-2026-77422", "lastModified": "2026-09-30T16:44:39.840", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77422", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-24T14:13:32.954382Z", "version": "2.0.3"}}]}, "published": "2026-09-23T19:19:15.863", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541"}, {"source": "security-advisories@github.com", "url": "https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae"}, {"source": "security-advisories@github.com", "url": "https://github.com/jline/jline3/pull/2012"}, {"source": "security-advisories@github.com", "url": "https://github.com/jline/jline3/pull/2018"}, {"source": "security-advisories@github.com", "url": "https://github.com/jline/jline3/releases/tag/4.3.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/jline/jline3/releases/tag/jline-3.30.15"}, {"source": "security-advisories@github.com", "url": "https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "org.jline/jline: JLine: Denial of Service via regular expression processing in built-in grep command", "id": "2539620", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539620"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1333", "details": ["A flaw was found in JLine, a Java library for handling console input. The built-in grep command accepts user-controlled regular expressions and automatically wraps them, which can amplify backtracking in the regular expression engine. A remote attacker could exploit this by providing a specially crafted regular expression, leading to excessive CPU consumption and indefinitely blocking a command worker. This can result in a Denial of Service (DoS) for affected systems."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-77422", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "jline", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-spark-operator-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cpu-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th-torch-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th-torch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Affected", "package_name": "opendaylight", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}], "public_date": "2026-09-23T18:09:32Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-77422\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-77422\nhttps://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541\nhttps://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae\nhttps://github.com/jline/jline3/pull/2012\nhttps://github.com/jline/jline3/pull/2018\nhttps://github.com/jline/jline3/releases/tag/4.3.1\nhttps://github.com/jline/jline3/releases/tag/jline-3.30.15\nhttps://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw"], "statement": "This is an Important denial of service flaw in the JLine library's built-in `grep` command. An attacker could provide a specially crafted regular expression, leading to excessive CPU consumption due to amplified backtracking in the regular expression engine. This could indefinitely block command workers, potentially resulting in a remote denial of service in applications that expose JLine's console input functionality, especially in remotely accessible shell sessions.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.30.15)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.3.1)"}}], "enrichment": {"confidence": 96.0, "confidence_source": "matching", "scores": [{"score": 96.0, "source": "matching"}]}, "original": {"product": "jline3", "source": "cna", "vendor": "jline"}, "product": "jline", "vendor": "jline"}], "created": "2026-09-23T20:45:09.998637+00:00", "updated": "2026-09-27T11:45:51.305608+00:00", "vendors": ["jline", "jline$PRODUCT$jline"]}