JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in
    grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled
    regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix
    and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands
    the backtracking search space, so a short nested-quantifier expression evaluated against non-matching
    input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed
    shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1. (CVE-2026-77422)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in     grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled     regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix     and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands     the backtracking search space, so a short nested-quantifier expression evaluated against non-matching     input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed     shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1. (CVE-2026-77422)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
473055	Echo: org.jline:jline-builtins: security update to 3.30.15	Tenable Cloud Security	Echo Local Security Checks	Local	high
473055	Echo: org.jline:jline-builtins: security update to 3.30.15	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
350269	Linux Distros Unpatched Vulnerability : CVE-2026-77422	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-77422

high

Tenable Plugins

high

high

high