High
jline, jline2 and 1 more products — security advisory
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.
- Products
- jline, jline2, jline3
- Affected versions
- 1.0-2, 1.0-3, 1.0-3build1, 2.11-1, 2.11-2, 2.11-4, 2.12.1-1, 2.14.6-1, 2.14.6-3, 2.14.6-4, 2.14.6-5, 2.14.6-6, 3.3.1-2, 3.3.1-3, 3.3.1-3ubuntu1, 3.3.1-4, 3.3.1-4build1, 3.3.1-5
- Fixed versions
- Not specified
- CVEs
- CVE-2026-77422
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:19 UTC · Revision 1
Source evidence
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.
osv:UBUNTU-CVE-2026-77422
jline
Fixed versions: Not specified
jline2
Fixed versions: Not specified
jline
Fixed versions: Not specified
jline2
Fixed versions: Not specified
jline
Fixed versions: Not specified
jline2
Fixed versions: Not specified
jline
Fixed versions: Not specified
jline2
Fixed versions: Not specified
jline
Fixed versions: Not specified
jline2
Fixed versions: Not specified
jline3
Fixed versions: Not specified
jline
Fixed versions: Not specified
jline2
Fixed versions: Not specified
jline3
Fixed versions: Not specified
jline
Fixed versions: Not specified
jline2
Fixed versions: Not specified
jline3
Fixed versions: Not specified
jline
Fixed versions: Not specified
jline2
Fixed versions: Not specified
jline3
Fixed versions: Not specified
Complete source record
{
"id": "01ae6cafe0f50b3a86ada78ebade66f8781dbf2cef0e7e53299fa7067a657410",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-77422",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-77422",
"summary": "JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.",
"evidence": "osv:UBUNTU-CVE-2026-77422",
"products": [
{
"name": {
"value": "jline",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0-2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "jline2",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.11-1",
"evidence": "/affected/1/versions"
},
{
"value": "2.11-2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "jline",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0-2",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "jline2",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.11-4",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "jline",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0-2",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "jline2",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.11-4",
"evidence": "/affected/5/versions"
},
{
"value": "2.12.1-1",
"evidence": "/affected/5/versions"
},
{
"value": "2.14.6-1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "jline",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0-2",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "jline2",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.14.6-3",
"evidence": "/affected/7/versions"
}
]
},
{
"name": {
"value": "jline",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0-3",
"evidence": "/affected/8/versions"
}
]
},
{
"name": {
"value": "jline2",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.14.6-4",
"evidence": "/affected/9/versions"
}
]
},
{
"name": {
"value": "jline3",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.3.1-2",
"evidence": "/affected/10/versions"
}
]
},
{
"name": {
"value": "jline",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0-3",
"evidence": "/affected/11/versions"
}
]
},
{
"name": {
"value": "jline2",
"evidence": "/affected/12/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.14.6-5",
"evidence": "/affected/12/versions"
}
]
},
{
"name": {
"value": "jline3",
"evidence": "/affected/13/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.3.1-3",
"evidence": "/affected/13/versions"
},
{
"value": "3.3.1-3ubuntu1",
"evidence": "/affected/13/versions"
}
]
},
{
"name": {
"value": "jline",
"evidence": "/affected/14/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0-3build1",
"evidence": "/affected/14/versions"
}
]
},
{
"name": {
"value": "jline2",
"evidence": "/affected/15/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.14.6-6",
"evidence": "/affected/15/versions"
}
]
},
{
"name": {
"value": "jline3",
"evidence": "/affected/16/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.3.1-4build1",
"evidence": "/affected/16/versions"
},
{
"value": "3.3.1-5",
"evidence": "/affected/16/versions"
}
]
},
{
"name": {
"value": "jline",
"evidence": "/affected/17/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0-3",
"evidence": "/affected/17/versions"
},
{
"value": "1.0-3build1",
"evidence": "/affected/17/versions"
}
]
},
{
"name": {
"value": "jline2",
"evidence": "/affected/18/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.14.6-6",
"evidence": "/affected/18/versions"
}
]
},
{
"name": {
"value": "jline3",
"evidence": "/affected/19/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.3.1-4",
"evidence": "/affected/19/versions"
},
{
"value": "3.3.1-4build1",
"evidence": "/affected/19/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2026-77422",
"aliases": [
"UBUNTU-CVE-2026-77422"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline",
"purl": "pkg:deb/ubuntu/jline?arch=source&distro=trusty",
"ecosystem": "Ubuntu:14.04:LTS"
},
"versions": [
"1.0-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline-java",
"binary_version": "1.0-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline2",
"purl": "pkg:deb/ubuntu/jline2?arch=source&distro=trusty",
"ecosystem": "Ubuntu:14.04:LTS"
},
"versions": [
"2.11-1",
"2.11-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline2-java",
"binary_version": "2.11-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline",
"purl": "pkg:deb/ubuntu/jline?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"1.0-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline-java",
"binary_version": "1.0-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline2",
"purl": "pkg:deb/ubuntu/jline2?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.11-4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline2-java",
"binary_version": "2.11-4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline",
"purl": "pkg:deb/ubuntu/jline?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1.0-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline-java",
"binary_version": "1.0-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline2",
"purl": "pkg:deb/ubuntu/jline2?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"2.11-4",
"2.12.1-1",
"2.14.6-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline2-java",
"binary_version": "2.14.6-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline",
"purl": "pkg:deb/ubuntu/jline?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.0-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline-java",
"binary_version": "1.0-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline2",
"purl": "pkg:deb/ubuntu/jline2?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"2.14.6-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline2-java",
"binary_version": "2.14.6-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline",
"purl": "pkg:deb/ubuntu/jline?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.0-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline-java",
"binary_version": "1.0-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline2",
"purl": "pkg:deb/ubuntu/jline2?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"2.14.6-4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline2-java",
"binary_version": "2.14.6-4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline3",
"purl": "pkg:deb/ubuntu/jline3?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"3.3.1-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline3-java",
"binary_version": "3.3.1-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline",
"purl": "pkg:deb/ubuntu/jline?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.0-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline-java",
"binary_version": "1.0-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline2",
"purl": "pkg:deb/ubuntu/jline2?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"2.14.6-5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline2-java",
"binary_version": "2.14.6-5"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline3",
"purl": "pkg:deb/ubuntu/jline3?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"3.3.1-3",
"3.3.1-3ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline3-java",
"binary_version": "3.3.1-3ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline",
"purl": "pkg:deb/ubuntu/jline?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.0-3build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline-java",
"binary_version": "1.0-3build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline2",
"purl": "pkg:deb/ubuntu/jline2?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"2.14.6-6"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline2-java",
"binary_version": "2.14.6-6"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline3",
"purl": "pkg:deb/ubuntu/jline3?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"3.3.1-4build1",
"3.3.1-5"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline3-java",
"binary_version": "3.3.1-5"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline",
"purl": "pkg:deb/ubuntu/jline?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.0-3",
"1.0-3build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline-java",
"binary_version": "1.0-3build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline2",
"purl": "pkg:deb/ubuntu/jline2?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"2.14.6-6"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline2-java",
"binary_version": "2.14.6-6"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jline3",
"purl": "pkg:deb/ubuntu/jline3?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"3.3.1-4",
"3.3.1-4build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77422.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libjline3-java",
"binary_version": "3.3.1-4build1"
}
]
}
}
],
"modified": "2026-10-17T13:01:08.548773808Z",
"provider": "osv",
"upstream": [
"CVE-2026-77422"
],
"references": [
"https://ubuntu.com/security/CVE-2026-77422",
"https://www.cve.org/CVERecord?id=CVE-2026-77422",
"https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw",
"https://github.com/jline/jline3/pull/2018",
"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae",
"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541",
"https://github.com/jline/jline3/pull/2012",
"https://github.com/jline/jline3/releases/tag/4.3.1",
"https://github.com/jline/jline3/releases/tag/jline-3.30.15"
]
},
"related_cves": [
{
"value": "CVE-2026-77422",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 361061,
"published_at": "2026-09-23T19:19:00+00:00"
}