CVE-2026-77420
Description
A flaw was found in JLine, a Java library for handling console input. An attacker who can control application or user configuration can supply a specially crafted regular expression to the HISTORY_IGNORE configuration variable. This malicious input can cause excessive CPU consumption when commands are added to history, leading to a Denial of Service (DoS) by indefinitely blocking the reader thread.
Statement
This vulnerability requires local access to modify the JLine HISTORY_IGNORE configuration variable. An attacker must be able to control application or user-level configuration in order to inject a malicious regular expression. There is no impact on data confidentiality or integrity, and the DoS is confined to the application's console input processing, it does not affect the broader system or network.
Mitigation
If application configuration allows user-supplied values to flow into HISTORY_IGNORE, validate or sanitize those values to reject regular expression metacharacters (e.g., nested quantifiers such as (a+)+) before they reach JLine's history processing.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 5.5 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
