Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.jline:jline-reader

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.5MavenAmendedPublished

    JLine: ReDoS via HISTORY_IGNORE Configuration Variable

    CVE-2026-77420 · GHSA-5q95-hrpc-m3w3

    Affected
    • Maven org.jline:jline-reader >= 4.0.0, < 4.3.1; >= 3.0.0, < 3.30.15
    Fixed in
    4.3.13.30.15· Vendor fix available
    Issue
    The JLine3 HISTORYIGNORE variable is converted into a Java regular expression with only partial escaping. As a result, regex metacharacters other than and : are passed through to the regex engine. A crafted value such as (a+)+b can cause catastrophic backtracking each time a command line is added to history, hanging the reader thread at high CPU. Details In reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java, matchPatterns() converts HISTORYIGNORE into a regex: This logic translates wildcard syntax but does not escape regex metacharacters such as (, ), +, ?, {, }, [, and ]. Those characters therefore reach the Java regex engine unchanged. Affected source location: - reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java - matchPatterns(String patterns, String line) PoC 1. Configure HISTORYIGNORE to a malicious pattern, for example: 2. At the JLine prompt, enter a long non-matching line: 3. Press Enter. Expected result: - The prompt does not…

    Recommended action: Upgrade to 4.3.1 or 3.30.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →