CVE-2026-77423

Name of the Vulnerable Software and Affected Versions JLine versions 3.0.0 through 3.30.14 JLine versions 4.x through 4.3.0

Description The built-in less viewer in this Java library for console input passes user-controlled search and display-filter patterns from the getPattern(boolean doDisplayPattern) function directly to the Java backtracking regular expression engine. When a nested-quantifier expression is evaluated against non-matching lines, it can cause excessive CPU consumption and indefinitely block the session thread. In Telnet or SSH deployments, repeated sessions can lead to the exhaustion of a bounded worker pool.

Recommendations Update to version 3.30.15. Update to version 4.3.1.