CyberRota Analysis
AI-GeneratedThe JLine library, specifically versions 3.0.0 to 3.30.15 and 4.3.1, is vulnerable due to its handling of user-controlled regular expressions in the built-in grep command, which can lead to excessive CPU consumption and potential denial of service. This vulnerability can indefinitely block command workers, particularly in remotely exposed shell sessions, making it critical for organizations using JLine in their Java applications to prioritize upgrading to versions 3.30.15 or 4.3.1 to mitigate this risk. Java developers and system administrators should address this issue promptly to ensure system stability and security.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.