Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jline:jline-reader | maven | >= 4.0.0, < 4.3.1 | 4.3.1 |
| org.jline:jline-reader | maven | >= 3.0.0, < 3.30.15 | 3.30.15 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-77420, is a Regular Expression Denial of Service (ReDoS) in the JLine3 library. The core issue lies within the matchPatterns function of org.jline.reader.impl.history.DefaultHistory.java. This function is responsible for converting the HISTORY_IGNORE configuration variable into a Java regular expression. In the vulnerable version, the implementation of this conversion was flawed: it only partially escaped special characters, specifically handling \, :, and *. All other regex metacharacters (such as (, ), +, ?, {, }, [, ]) were appended directly to the StringBuilder without being escaped. This allowed an attacker to supply a malicious pattern like (a+)+b via the HISTORY_IGNORE variable. When a long, non-matching input string was then processed against this crafted regex, the Java regex engine would suffer from catastrophic backtracking, consuming excessive CPU resources and leading to a denial of service. The provided patch clearly shows the removal of direct character appending (sb.append(ch);) and its replacement with sb.append(Pattern.quote(String.valueOf(ch)));), which correctly escapes all special regex characters. Additionally, the patch introduces SafeRegex.matches() to provide a timeout mechanism, further mitigating ReDoS risks. Therefore, the matchPatterns function is definitively the vulnerable component, as it directly processes the malicious input and constructs the unsafe regex.
org.jline.reader.impl.history.DefaultHistory.matchPatternsreader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java