CVE-2026-77422High· 7.5▾ MidnightPoC availableJLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.5%
Last analysed / modified upstream
0.5% → 0.6%
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.jline:jline-builtins >= 4.0.0, < 4.3.1org.jline:jline-builtins >= 3.0.0, < 3.30.15Patched in:
org.jline:jline-builtins 4.3.1org.jline:jline-builtins 3.30.15Source: https://github.com/advisories/GHSA-r2xf-8xr9-62gw
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77423High· 7.5JLine is a Java library for handling console input
CVE-2026-77421Medium· 6.5JLine is a Java library for handling console input
CVE-2026-77420Medium· 5.5JLine is a Java library for handling console input
CVE-2026-89407High· 7.5NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT…
CVE-2026-68497High· 7.5jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLD…
CVE-2026-111997Medium· 5.3ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process