Affected: CleanStart: apache-nifi, CleanStart: apache-zookeeper, CleanStart: kafka

CVE-2026-77422 affects multiple packages. JLine is a Java library for handling console input. See references for individual vulnerability details.

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.

Affected: Maven: org.jline:jline-builtins

### Summary

The JLine3 built-in `grep` command wraps the user-supplied regular expression with `.*` before compiling it with Java's backtracking regex engine. This amplifies catastrophic backtracking and allows a short pattern such as `(a+)+b` to hang the command thread on non-matching input. In environments that expose the JLine shell to remote users, this is a denial-of-service issue.

### Details

In `builtins/src/main/java/org/jline/builtins/PosixCommands.java`, the grep implementation rewrites the user pattern before compilation:

```java String regex = args.remove(0); String regexp = regex; if (opt.isSet("word-regexp")) { regexp = "\\b" + regexp + "\\b"; } if (opt.isSet("line-regexp")) { regexp = "^" + regexp + "$"; } else { regexp = ".*" + regexp + ".*"; } ```

The transformed pattern is compiled with `Pattern.compile(...)` and then used to test each input line. For a payload such as `(a+)+b`, the automatic `.*` prefix and suffix increase the backtracking search space substantially.

Affected source location: - `builtins/src/main/java/org/jline/builtins/PosixCommands.java` - `grep(...)`

### PoC

1. Create a file containing a long run of `a` characters:

```sh printf 'aaaaaaaaaaaaaaaaaaaaaaa\n' > /tmp/testfile.txt ```

2. Run JLine3's built-in `grep` against that file:

```sh grep '(a+)+b' /tmp/testfile.txt ```

Expected result: - The command stops responding. - The executing thread consumes high CPU.

Reproduction environment: - JLine3 on x86_64 Linux -…

Affected: Ubuntu:14.04:LTS: jline, Ubuntu:14.04:LTS: jline2, Ubuntu:16.04:LTS: jline, Ubuntu:16.04:LTS: jline2, Ubuntu:18.04:LTS: jline, Ubuntu:18.04:LTS: jline2, Ubuntu:20.04:LTS: jline, Ubuntu:20.04:LTS: jline2, Ubuntu:22.04:LTS: jline, Ubuntu:22.04:LTS: jline2 and 7 more

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.