JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in
    nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in
    builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine
    without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching
    buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote
    multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions
    3.30.15 and 4.3.1. (CVE-2026-77421)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in     nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in     builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine     without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching     buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote     multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions     3.30.15 and 4.3.1. (CVE-2026-77421)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
473054	Echo: org.jline:jline-builtins: security update to 3.30.15	Tenable Cloud Security	Echo Local Security Checks	Local	medium
473054	Echo: org.jline:jline-builtins: security update to 3.30.15	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
350265	Linux Distros Unpatched Vulnerability : CVE-2026-77421	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-77421

medium

Tenable Plugins

medium

medium

medium