EUVD-2026-85531

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPatternboolean doDisplayPattern in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's...

CVE-2026-77423 JLine: ReDoS in Built-in Less Viewer Search

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPatternboolean doDisplayPattern in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's...

CVE-2026-77423 JLine: ReDoS in Built-in Less Viewer Search

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPatternboolean doDisplayPattern in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's...

CVE-2026-77423

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPatternboolean doDisplayPattern in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's...

GHSA-R2XF-8XR9-62GW JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping

Summary The JLine3 built-in grep command wraps the user-supplied regular expression with . before compiling it with Java's backtracking regex engine. This amplifies catastrophic backtracking and allows a short pattern such as a++b to hang the command thread on non-matching input. In environments...

com.aspectran:aspectow-appmon-demo (3.2.0), com.aspectran:aspectran-all (>=9.4.3, <=9.6.2) +31 more potentially affected by CVE-2026-77422 via org.jline:jline-builtins (>=4.0.0, <=4.3.0)

org.jline:jline-builtins MAVEN version =4.0.0, =9.4.3, =9.4.3, =9.4.3, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.21.0 and more Source cves: CVE-2026-77422 Source advisory: OSV:GHSA-R2XF-8XR9-62GW...

com.aspectran:aspectow-appmon-demo (3.2.0), com.aspectran:aspectran-all (>=9.4.3, <=9.6.2) +31 more potentially affected by CVE-2026-77422 via org.jline:jline-builtins (>=4.0.0, <=4.3.0)

org.jline:jline-builtins MAVEN version =4.0.0, =9.4.3, =9.4.3, =9.4.3, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.21.0 and more Source cves: CVE-2026-77422 Source advisory: SNYK:JAVA-ORGJLINE-20079221...

com.aspectran:aspectow-appmon-demo (3.2.0), com.aspectran:aspectran-all (>=9.4.3, <=9.6.2) +31 more potentially affected by CVE-2026-77422 via org.jline:jline-builtins (>=4.0.0, <=4.3.0)

org.jline:jline-builtins MAVEN version =4.0.0, =9.4.3, =9.4.3, =9.4.3, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.21.0 and more Source cves: CVE-2026-77422 Source advisory: GHSA-R2XF-8XR9-62GW...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java. An attacker can hang the command thread by supplying a pattern such as a++b against non-matching input, whic...

ch.epfl.lara:scala3-language-server_3 (>=3.9.0-rc1-bin-20260516-64de706-nightly, <=3.10.0-rc1-bin-20260720-513d792-nightly), ch.epfl.lara:scala3-repl_3 (>=3.9.0-rc1-bin-20260516-64de706-nightly, <=3.10.0-rc1-bin-20260720-513d792-nightly) +68 more potentially affected by CVE-2026-77420 via org.jline:jline-reader (>=4.0.0, <=4.3.0)

org.jline:jline-reader MAVEN version =4.0.0, =3.9.0-rc1-bin-20260516-64de706-nightly, =3.9.0-rc1-bin-20260516-64de706-nightly, =3.9.0-rc1-bin-20260516-64de706-nightly, =26.4.2, =26.4.2, =9.4.3, =9.4.3, =9.4.3, =3.9.0-rc5-p11, =3.9.0-rc5-p11, =4.0.660, =4.0.665 and more Source cves: CVE-2026-77420...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java through matchPatterns in the HISTORYIGNORE history filter. An attacker can hang the reader thread and drive CPU usage...

CVE-2026-77420 JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatternsString patterns, String line in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORYIGNORE configuration value into a Java regular expression...

CVE-2026-77420

The JLine Java library (versions 3.0.0 to 3.30.14 and 4.3.1) is vulnerable to a Denial of Service (DoS) attack due to improper escaping of the HISTORY_IGNORE configuration value. The DefaultHistory.matchPatterns method in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java conv...

CVE-2026-77420 JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatternsString patterns, String line in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORYIGNORE configuration value into a Java regular expression...

CVE-2026-77420 JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatternsString patterns, String line in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORYIGNORE configuration value into a Java regular expression...

EUVD-2026-85528

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatternsString patterns, String line in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORYIGNORE configuration value into a Java regular expression...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +4742 more potentially affected by CVE-2026-77420 via org.jline:jline-reader (>=3.2.0, <=3.30.14)

org.jline:jline-reader MAVEN version =3.2.0, =0.14.1, =0.1.0, =0.9.6, =0.15.3, =0.12.0, =0.9.6, =0.15.3, =0.9.6, =0.9.6, =0.15.3, =0.9.6, =0.15.3, =0.14.1, =0.9.6, =0.14.3 and more Source cves: CVE-2026-77420 Source advisory: MEND:CVE-2026-77420...

ch.epfl.lara:scala3-language-server_3 (>=3.9.0-rc1-bin-20260516-64de706-nightly, <=3.10.0-rc1-bin-20260720-513d792-nightly), ch.epfl.lara:scala3-repl_3 (>=3.9.0-rc1-bin-20260516-64de706-nightly, <=3.10.0-rc1-bin-20260720-513d792-nightly) +68 more potentially affected by CVE-2026-77420 via org.jline:jline-reader (>=4.0.0, <=4.3.0)

org.jline:jline-reader MAVEN version =4.0.0, =3.9.0-rc1-bin-20260516-64de706-nightly, =3.9.0-rc1-bin-20260516-64de706-nightly, =3.9.0-rc1-bin-20260516-64de706-nightly, =26.4.2, =26.4.2, =9.4.3, =9.4.3, =9.4.3, =3.9.0-rc5-p11, =3.9.0-rc5-p11, =4.0.660, =4.0.665 and more Source cves: CVE-2026-77420...

CVE-2026-77420

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatternsString patterns, String line in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORYIGNORE configuration value into a Java regular expression...

CVE-2026-77420

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatternsString patterns, String line in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORYIGNORE configuration value into a Java regular expression...