Bug 2539624 (CVE-2026-77420)

Summary: CVE-2026-77420 org.jline/jline-reader: JLine: Denial of Service vulnerability in history configuration processing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: asyoung, ataylor, csuconic, dbruscin, eglynn, ehugonne, gmalinko, gtully, janstey, jhollowa, jjoyce, jpretori, jschluet, jsherman, kaycoth, kvanderr, lhh, mburns, mgarciac, pdelbell, prichard, rgemmell, rgodfrey, rstepani, sthirugn, tbish, tlavocat
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in JLine, a Java library for handling console input. An attacker who can control application or user configuration can supply a specially crafted regular expression to the `HISTORY_IGNORE` configuration variable. This malicious input can cause excessive CPU consumption when commands are added to history, leading to a Denial of Service (DoS) by indefinitely blocking the reader thread.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-23 18:25:23 UTC
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1.