CVE-2026-77421Medium· 6.5▾ SunlitJLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jlin…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.jline:jline-builtins >= 4.0.0, < 4.3.1org.jline:jline-builtins >= 3.0.0, < 3.30.15Patched in:
org.jline:jline-builtins 4.3.1org.jline:jline-builtins 3.30.15Source: https://github.com/advisories/GHSA-ph9c-7hw9-vhhw
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77422High· 7.5JLine is a Java library for handling console input
CVE-2026-77423High· 7.5JLine is a Java library for handling console input
CVE-2026-77420Medium· 5.5JLine is a Java library for handling console input
CVE-2026-89407High· 7.5NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT…
CVE-2026-68497High· 7.5jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLD…
CVE-2026-115349High· 7.5Mistune 3.0.0 before 3.3.0 Denial of Service via Nested Bracket Parsing