Most recent entries from all

CLEANSTART-2026-KE95640 — JLine is a Java library for handling console input

2026-10-04T22:42:42.541035+00:00

Affected: CleanStart: apache-nifi, CleanStart: apache-zookeeper, CleanStart: kafka, CleanStart: elasticsearch

CVE-2026-77420 affects multiple packages. JLine is a Java library for handling console input. See references for individual vulnerability details.

fkie_cve-2026-77420

2026-10-04T22:42:42.541142+00:00

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1.

GHSA-5q95-hrpc-m3w3 — JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

2026-10-04T22:42:42.541199+00:00

Affected: Maven: org.jline:jline-reader

### Summary

The JLine3 `HISTORY_IGNORE` variable is converted into a Java regular expression with only partial escaping. As a result, regex metacharacters other than `*` and `:` are passed through to the regex engine. A crafted value such as `(a+)+b` can cause catastrophic backtracking each time a command line is added to history, hanging the reader thread at high CPU.

### Details

In `reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java`, `matchPatterns()` converts `HISTORY_IGNORE` into a regex:

```java for (int i = 0; i < patterns.length(); i++) { char ch = patterns.charAt(i); if (ch == '\\') { ch = patterns.charAt(++i); sb.append(ch); } else if (ch == ':') { sb.append('|'); } else if (ch == '*') { sb.append('.').append('*'); } else { sb.append(ch); } } return line.matches(sb.toString()); ```

This logic translates wildcard syntax but does not escape regex metacharacters such as `(`, `)`, `+`, `?`, `{`, `}`, `[`, and `]`. Those characters therefore reach the Java regex engine unchanged.

Affected source location: - `reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java` - `matchPatterns(String patterns, String line)`

### PoC

1. Configure `HISTORY_IGNORE` to a malicious pattern, for example:

```sh set history-ignore "(a+)+b" ```

2. At the JLine prompt, enter a long non-matching line:

```text aaaaaaaaaaaaaaaaaaaaaaaaaaax ```

3. Press Enter.

Expected result: - The prom…

UBUNTU-CVE-2026-77420

2026-10-04T22:42:42.541301+00:00

Affected: Ubuntu:14.04:LTS: jline, Ubuntu:14.04:LTS: jline2, Ubuntu:16.04:LTS: jline, Ubuntu:16.04:LTS: jline2, Ubuntu:18.04:LTS: jline, Ubuntu:18.04:LTS: jline2, Ubuntu:20.04:LTS: jline, Ubuntu:20.04:LTS: jline2, Ubuntu:22.04:LTS: jline, Ubuntu:22.04:LTS: jline2 and 7 more