Regular Expression Denial of Service (ReDoS)Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java. An attacker can hang the command thread by supplying a pattern such as (a+)+b against non-matching input, which triggers catastrophic backtracking when grep wraps the user regex with .*...* and evaluates it with Java’s backtracking regex engine. This can consume CPU indefinitely and make the shell unresponsive for other users in deployments that expose the built-in shell remotely.
How to fix Regular Expression Denial of Service (ReDoS)? Upgrade org.jline:jline-builtins to version 3.30.15, 4.3.1 or higher.
| [3.0.0,3.30.15)[4.0.0,4.3.1) |
Regular Expression Denial of Service (ReDoS)Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the Less viewer search and display-filter matching in builtins/src/main/java/org/jline/builtins/Less.java. An attacker can hang the session thread by supplying a malicious search or filter pattern such as (a+)+b through the less viewer’s / or & input. The vulnerable code compiles and applies user-controlled patterns with Pattern.matcher(...).find() against file content and displayed lines, so a backtracking-heavy expression can consume excessive CPU on non-matching input. In exposed Telnet or SSH deployments, this can freeze the affected session and exhaust worker threads.
How to fix Regular Expression Denial of Service (ReDoS)? Upgrade org.jline:jline-builtins to version 3.30.15, 4.3.1 or higher.
| [3.0.0,3.30.15)[4.0.0,4.3.1) |
Regular Expression Denial of Service (ReDoS)Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) through the doSearch(String text) search routine in the org.jline.builtins.Nano editor. An attacker can hang the editor session and drive CPU usage high by entering a crafted regex search pattern such as (a+)+b in regex search mode. When Nano compiles and applies the user-supplied search term as a Java regex, nested-quantifier patterns trigger catastrophic backtracking against the buffer text. In remote or multi-user deployments that expose the editor, this stalls the worker thread handling that session and prevents the user from continuing to interact with the editor.
How to fix Regular Expression Denial of Service (ReDoS)? Upgrade org.jline:jline-builtins to version 3.30.15, 4.3.1 or higher.
| [3.0.0,3.30.15)[4.0.0,4.3.1) |
