Bug 2539623 (CVE-2026-77421)

Summary:	CVE-2026-77421 org.jline/jline-builtins: JLine: Denial of Service in Nano Editor Regex Search
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	asyoung, ataylor, csuconic, dbruscin, eglynn, ehugonne, gmalinko, gtully, janstey, jhollowa, jjoyce, jpretori, jschluet, jsherman, kaycoth, kvanderr, lhh, mburns, mgarciac, pdelbell, prichard, rgemmell, rgodfrey, rstepani, sthirugn, tbish, tlavocat
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the JLine built-in nano editor's regular expression (regex) search mode. A remote attacker could exploit this by providing a specially crafted search term. This could lead to excessive central processing unit (CPU) consumption, causing the editor session to become unresponsive and potentially leading to a denial of service (DoS) for affected users or worker threads in multi-user deployments.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-23 18:25:16 UTC

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1.