{"id":"CVE-2026-77420","summary":"JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable","details":"JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1.","aliases":["GHSA-5q95-hrpc-m3w3"],"modified":"2026-09-25T08:09:03.719906Z","published":"2026-09-23T18:11:25.998Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-1333"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77420.json"},"references":[{"type":"WEB","url":"https://github.com/jline/jline3/releases/tag/4.3.1"},{"type":"WEB","url":"https://github.com/jline/jline3/releases/tag/jline-3.30.15"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77420.json"},{"type":"ADVISORY","url":"https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77420"},{"type":"FIX","url":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541"},{"type":"FIX","url":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae"},{"type":"FIX","url":"https://github.com/jline/jline3/pull/2012"},{"type":"FIX","url":"https://github.com/jline/jline3/pull/2018"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jline/jline3","events":[{"introduced":"cc36cb24e2d5aedc5c25476448e6841dde01d50f"},{"introduced":"e2422d778d98d935edd3d250a0d32b75a802c142"},{"fixed":"b880666cb543c2dc31054ff2203ce5f84190867b"},{"fixed":"6b83c24b6c3900f1c85d113dbeff23280e024f04"},{"fixed":"1d5fc3099e77938b971e197211cad2d4fbb17541"},{"fixed":"341ee69ccc57b7733c1b40d6993219b64b3206ae"}],"database_specific":{"extracted_events":[{"introduced":"3.0.0"},{"fixed":"3.30.15"},{"introduced":"4.0.0"},{"fixed":"4.3.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["4.3.0","jline-3.30.14","4.2.1","4.2.0","4.1.3","4.1.2","4.1.1","4.1.0","jline-3.30.13","jline-3.30.12","jline-3.30.11","jline-3.30.10","4.0.12","4.1.0-SNAPSHOT","4.0.11","4.0.10","4.0.9","4.0.8","4.0.7","jline-3.30.9","4.0.6","4.0.5","4.0.4","4.0.3","4.0.2","4.0.1","jline-3.30.8","4.0.0","jline-3.30.7","jline-3.30.6","jline-3.30.5","4.0.0-SNAPSHOT","jline-3.30.4","jline-3.30.3","jline-3.30.2","jline-3.30.1","jline-3.30.0","jline-3.29.0","jline-3.28.0","jline-3.27.1","jline-3.27.0","jline-parent-3.26.3","jline-parent-3.26.2","jline-parent-3.26.1","jline-parent-3.26.0","jline-parent-3.25.1","jline-parent-3.25.0","jline-parent-3.24.1","jline-parent-3.24.0","jline-parent-3.23.0","jline-parent-3.22.0","jline-parent-3.21.0","jline-parent-3.20.0","jline-parent-3.19.0","jline-parent-3.18.0","jline-parent-3.17.1","jline-parent-3.17.0","jline-parent-3.16.0","jline-parent-3.14.1","jline-parent-3.14.0","jline-parent-3.13.3","jline-parent-3.13.2","jline-parent-3.13.1","jline-parent-3.13.0","jline-parent-3.12.1","jline-parent-3.12.0","jline-parent-3.11.0","jline-parent-3.10.0","jline-parent-3.9.0","jline-parent-3.8.2","jline-parent-3.8.1","jline-parent-3.8.0","jline-parent-3.7.1","jline-parent-3.7.0","jline-parent-3.6.2","jline-parent-3.6.1","jline-parent-3.6.0","jline-parent-3.5.2","jline-parent-3.5.1","jline-parent-3.5.0","jline-parent-3.4.0","jline-3.3.1","jline-parent-3.3.0","jline-parent-3.2.0","jline-3.1.1","jline-3.1.0","jline-3.0.1","jline-3.0.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-77420.json","vanir_signatures_modified":"2026-09-25T08:09:03Z","vanir_signatures":[{"id":"CVE-2026-77420-0635c959","signature_type":"Line","signature_version":"v1","source":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","target":{"file":"builtins/src/main/java/org/jline/builtins/Less.java"},"deprecated":false,"digest":{"line_hashes":["211847395029071779537813525948676755845","229387202716380985349379298390493230900","213325916396492650593781291365340830841","98110787745695918911190647315211281820","302379449834329840962473715734785094957","181336586467390309758235877302890576593","63886566009641479150464737680700634969","128750563267022831767552352930540262106","302379449834329840962473715734785094957","181336586467390309758235877302890576593","63886566009641479150464737680700634969","128750563267022831767552352930540262106","67429498282413427552205201606880127615","45871482184594873974543727715945791034","272725369356223314561846406893078529706","119595900210303653043465144051341979303","129121147844741803832226940052127245563","284674342482881110905770582696962642309","172528078777003599006259052219646139432"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"151270442538399355370881816864893136013","length":919},"id":"CVE-2026-77420-0ef2b214","signature_type":"Function","signature_version":"v1","source":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","target":{"file":"reader/src/main/java/org/jline/reader/impl/LineReaderImpl.java","function":"matchPreviousCommand"}},{"source":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","target":{"file":"builtins/src/main/java/org/jline/builtins/Commands.java","function":"history"},"deprecated":false,"digest":{"function_hash":"31929425313364030403575528498442584193","length":5901},"id":"CVE-2026-77420-0ffa4468","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","target":{"file":"builtins/src/main/java/org/jline/builtins/Nano.java","function":"doSearch"},"deprecated":false,"digest":{"function_hash":"241486813939779018576398363286554169119","length":416},"id":"CVE-2026-77420-13d52a82","signature_type":"Function"},{"id":"CVE-2026-77420-1f565a91","signature_type":"Line","signature_version":"v1","source":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","target":{"file":"builtins/src/main/java/org/jline/builtins/Commands.java"},"deprecated":false,"digest":{"line_hashes":["178319731741312207683571793096516234769","12556404053362548702584942917014982658","8171131083346718661829945187620298890","260398855623883359627773167146214687590","277690242317742092177651543154053094882","235995257785603843063676863311536726300","148602099634117174428759137116853515010","334355222773384869968163947030142935891","94553622508097585508908884643395544556","277166766600948645089390616691085535528","99163146704290961158105517394327274626","146921127147813536625229314039716321456","306161811959563034376918009616130122595","2785967230058014909817107567244236680","288142231279735686720365052929787222618","101041858138841044123626361655613294906","137668440198822955889980173506208570453","99712348503884543696541710884793448017","298710213300111448620492618144769335917","57624358563148821610114755246725092200","30825312365359937755226784762828227109"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","target":{"file":"reader/src/main/java/org/jline/reader/impl/LineReaderImpl.java"},"deprecated":false,"digest":{"line_hashes":["76063306507212553600036099012286162370","115907836173607341716366299204228329896","226316532599281024486461993779327280567","235549869238473421025157435623997823541","80200827212519718961952213838203854434","98267657366565474554893792598841108938","175181438891394904963622484237302800863","288100670388844583475947914256183323417","119626796629947137191484839586412152986","138788668608895951632989764333317416764","275339273032221250492286487072085453729","202750950213817318310691018800708123986","82781601609818804617573135912960907734","219233364798827875008326341356955945987","175426113014379336652972701201387943865","181279113492463310725749105151938305676","92051854658475391557892448425145033611","272082034783368843163127074208757257514","196670381877916053949706122147136091313","33734209223894863802981565713541747282","252499028787436079992681734330622240762","212937394824001864812461381562189147527","312136913961670834327250937530914059767","166523993257244195988031805005482664874","144530465127750350442870239869847236108","201710050194473051008504136317026210824","255689952688753798873048043468629584718","209224168380627574755609838313852928908","231988996314149655152247389586098954264","178432629076512960055139466280470657323","301098949640277708354781916868593287076","135389056655848283894427613770143537074"],"threshold":0.9},"id":"CVE-2026-77420-2c469da3"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","target":{"function":"matchPatterns","file":"reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java"},"deprecated":false,"digest":{"function_hash":"269240621813353898412445627208457128788","length":533},"id":"CVE-2026-77420-35dbda41"},{"deprecated":false,"digest":{"line_hashes":["203854378939403555765425643276125628138","24048793074843594691811706887723650881","184030266740302065009997195874821403021","265559030407187319315157186242548973226","150248704267717115305799984274273544372","301254194913274245794171470890633811765","59430530834550440051987376890899549057","83727978563059905401567446034302678816","338736612975321702878174720568322191069","326121242655075064575344650820430110144","178109870896641267155906266909732672525","205442725283880667048542339839821370835","314368346461195710573831393554434548331"],"threshold":0.9},"id":"CVE-2026-77420-3b23cbe7","signature_type":"Line","signature_version":"v1","source":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","target":{"file":"terminal/src/main/java/org/jline/utils/AttributedString.java"}},{"source":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","target":{"function":"doSearch","file":"builtins/src/main/java/org/jline/builtins/Nano.java"},"deprecated":false,"digest":{"length":416,"function_hash":"241486813939779018576398363286554169119"},"id":"CVE-2026-77420-4a6b1844","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-77420-52b91aa2","signature_type":"Function","signature_version":"v1","source":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","target":{"function":"toBeDisplayed","file":"builtins/src/main/java/org/jline/builtins/Less.java"},"deprecated":false,"digest":{"function_hash":"34855124013900986005707274451366841599","length":151}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","target":{"file":"builtins/src/main/java/org/jline/builtins/Commands.java","function":"history"},"deprecated":false,"digest":{"length":5901,"function_hash":"31929425313364030403575528498442584193"},"id":"CVE-2026-77420-5c1ee0a8"},{"target":{"file":"builtins/src/main/java/org/jline/builtins/Nano.java"},"deprecated":false,"digest":{"line_hashes":["221974806097293220863381694826975375856","189998342581856202561663898810926278665","328955115785060563933987946977843594444","224399689785288962481907965283586857214","302455219432648499812577237244831546273","23864673115776073176727612670127707894","50632066645148974814444842330997032520","39260530014803825782017748217529862697","169831575792889724509453586437062990496","75349051710754775071886520899919742711","332377008410212982126341685015529147104","150328284262892305764473431203388395617","61128705694299840304130710426188138793","193261919426004751544202913173351150183","44763139388963697162432500794677065228","12233165799250511146271142169448453621","202022780525027843913043235779156972803"],"threshold":0.9},"id":"CVE-2026-77420-6119b4e9","signature_type":"Line","signature_version":"v1","source":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541"},{"deprecated":false,"digest":{"length":533,"function_hash":"269240621813353898412445627208457128788"},"id":"CVE-2026-77420-64e2cfe2","signature_type":"Function","signature_version":"v1","source":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","target":{"file":"reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java","function":"matchPatterns"}},{"deprecated":false,"digest":{"function_hash":"193711692779298097750448330594913746497","length":250},"id":"CVE-2026-77420-66dcb36f","signature_type":"Function","signature_version":"v1","source":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","target":{"file":"reader/src/main/java/org/jline/reader/impl/LineReaderImpl.java","function":"matches"}},{"digest":{"line_hashes":["69539085325526020539623188769690878243","104759095995116257099553870118400787386","225274483165571419967060647710372636803","166892991884416697437928048181401533062","170795763391956511041102421412793359172","122569529698886728765609351623230499280","204431298514858500145766653998591189031","10540280951521438750151247979155831548","189279793232196136582239900040246737034","86598178884304387164785449416796185623","261447932358322192734086262847294718327","339100054709231144943640724027604572613","181160917946117924482702090169136750434","104330346372070974586328786817027840602","336446137665121700249389398461543928706","253273469553563809256984685583684525513","7490643149463113239729338465599353299","217793099223135913788504923435908092628","229448522548310353027451166456202908882","136605399174002097281276864036983679383","287095890161963105217003990224332050697","127586267909918281055457521130266114855","93299880370042073175368767877007840698","224337584606787699199106693750323939116","69576556569702247582174362995586493153","22332404349511883654311952031296177623"],"threshold":0.9},"id":"CVE-2026-77420-6b3c1799","signature_type":"Line","signature_version":"v1","source":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","target":{"file":"builtins/src/main/java/org/jline/builtins/PosixCommands.java"},"deprecated":false},{"digest":{"function_hash":"44265294208977985259247205897383247599","length":791},"id":"CVE-2026-77420-860e4bdb","signature_type":"Function","signature_version":"v1","source":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","target":{"file":"builtins/src/main/java/org/jline/builtins/Less.java","function":"moveToNextMatch"},"deprecated":false},{"source":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","target":{"file":"terminal/src/main/java/org/jline/utils/AttributedString.java","function":"styleMatches"},"deprecated":false,"digest":{"function_hash":"302890851227800978806481307232124723464","length":520},"id":"CVE-2026-77420-8861f9fe","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"302890851227800978806481307232124723464","length":520},"id":"CVE-2026-77420-8e223a27","signature_type":"Function","signature_version":"v1","source":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","target":{"file":"terminal/src/main/java/org/jline/utils/AttributedString.java","function":"styleMatches"}},{"deprecated":false,"digest":{"function_hash":"98638218794382726970821803781098566540","length":830},"id":"CVE-2026-77420-9037d5c4","signature_type":"Function","signature_version":"v1","source":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","target":{"file":"builtins/src/main/java/org/jline/builtins/Less.java","function":"moveToPreviousMatch"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","target":{"file":"builtins/src/main/java/org/jline/builtins/Commands.java"},"deprecated":false,"digest":{"line_hashes":["178319731741312207683571793096516234769","12556404053362548702584942917014982658","8171131083346718661829945187620298890","260398855623883359627773167146214687590","277690242317742092177651543154053094882","235995257785603843063676863311536726300","148602099634117174428759137116853515010","334355222773384869968163947030142935891","94553622508097585508908884643395544556","277166766600948645089390616691085535528","99163146704290961158105517394327274626","146921127147813536625229314039716321456","306161811959563034376918009616130122595","2785967230058014909817107567244236680","288142231279735686720365052929787222618","101041858138841044123626361655613294906","137668440198822955889980173506208570453","99712348503884543696541710884793448017","298710213300111448620492618144769335917","57624358563148821610114755246725092200","30825312365359937755226784762828227109"],"threshold":0.9},"id":"CVE-2026-77420-a2821f87"},{"deprecated":false,"digest":{"length":919,"function_hash":"151270442538399355370881816864893136013"},"id":"CVE-2026-77420-a44764f6","signature_type":"Function","signature_version":"v1","source":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","target":{"file":"reader/src/main/java/org/jline/reader/impl/LineReaderImpl.java","function":"matchPreviousCommand"}},{"source":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","target":{"file":"reader/src/main/java/org/jline/reader/impl/LineReaderImpl.java"},"deprecated":false,"digest":{"line_hashes":["76063306507212553600036099012286162370","115907836173607341716366299204228329896","226316532599281024486461993779327280567","235549869238473421025157435623997823541","80200827212519718961952213838203854434","98267657366565474554893792598841108938","175181438891394904963622484237302800863","288100670388844583475947914256183323417","119626796629947137191484839586412152986","138788668608895951632989764333317416764","275339273032221250492286487072085453729","202750950213817318310691018800708123986","82781601609818804617573135912960907734","219233364798827875008326341356955945987","175426113014379336652972701201387943865","181279113492463310725749105151938305676","92051854658475391557892448425145033611","272082034783368843163127074208757257514","196670381877916053949706122147136091313","33734209223894863802981565713541747282","252499028787436079992681734330622240762","212937394824001864812461381562189147527","312136913961670834327250937530914059767","166523993257244195988031805005482664874","144530465127750350442870239869847236108","201710050194473051008504136317026210824","255689952688753798873048043468629584718","209224168380627574755609838313852928908","231988996314149655152247389586098954264","178432629076512960055139466280470657323","301098949640277708354781916868593287076","135389056655848283894427613770143537074"],"threshold":0.9},"id":"CVE-2026-77420-ba0d6615","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","target":{"file":"builtins/src/main/java/org/jline/builtins/Nano.java"},"deprecated":false,"digest":{"line_hashes":["221974806097293220863381694826975375856","189998342581856202561663898810926278665","328955115785060563933987946977843594444","224399689785288962481907965283586857214","302455219432648499812577237244831546273","23864673115776073176727612670127707894","50632066645148974814444842330997032520","39260530014803825782017748217529862697","169831575792889724509453586437062990496","75349051710754775071886520899919742711","332377008410212982126341685015529147104","150328284262892305764473431203388395617","61128705694299840304130710426188138793","193261919426004751544202913173351150183","44763139388963697162432500794677065228","12233165799250511146271142169448453621","202022780525027843913043235779156972803"],"threshold":0.9},"id":"CVE-2026-77420-bbdef97a","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-77420-c5179363","signature_type":"Function","signature_version":"v1","source":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","target":{"file":"builtins/src/main/java/org/jline/builtins/Less.java","function":"moveToNextMatch"},"deprecated":false,"digest":{"function_hash":"44265294208977985259247205897383247599","length":791}},{"deprecated":false,"digest":{"function_hash":"276097788690972132940572451486653760843","length":6853},"id":"CVE-2026-77420-c9157f1e","signature_type":"Function","signature_version":"v1","source":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","target":{"file":"builtins/src/main/java/org/jline/builtins/PosixCommands.java","function":"grep"}},{"digest":{"function_hash":"21413857550686275860940694216210777416","length":6069},"id":"CVE-2026-77420-cc04547e","signature_type":"Function","signature_version":"v1","source":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","target":{"file":"builtins/src/main/java/org/jline/builtins/PosixCommands.java","function":"grep"},"deprecated":false},{"id":"CVE-2026-77420-d0a86727","signature_type":"Line","signature_version":"v1","source":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","target":{"file":"reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["80179759171187753690667148518067752633","201076907080784268137841881846477883868","254126956094975974698694370644733459833","165316243256998319184995712333359475999","142673402057294089072814400994749882480","334266380321006765638475498898546571109","189683339282809975904306538885861597350","222945838212121096508858091879142058923","90726326184989210708088741033029481449","278174453271710737091762000347408130176","301318976054523105109591546340229999217","229945530633891349920094784437114837889","271230882549174657463496796141932410325","282770784397242883421265679457259203442","246531610445563869144931801337895668299","15138475248557406236849728988410725024","147006916420222041370611371448050658037","210273853484005799120481782100937250227","176349274963678780310474767024050121400","218404584036008783808025732519204954311","142424273289479098595164973135647767409","245731252807577806810321165857500723770","276132803957739853615761959438342084446","17290598419729446084999452946523014363","63460410324017274335894406836835168408","273844251083326363050009551682752983712"]}},{"id":"CVE-2026-77420-dac48930","signature_type":"Line","signature_version":"v1","source":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","target":{"file":"reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["80179759171187753690667148518067752633","201076907080784268137841881846477883868","254126956094975974698694370644733459833","165316243256998319184995712333359475999","142673402057294089072814400994749882480","334266380321006765638475498898546571109","189683339282809975904306538885861597350","222945838212121096508858091879142058923","90726326184989210708088741033029481449","278174453271710737091762000347408130176","301318976054523105109591546340229999217","229945530633891349920094784437114837889","271230882549174657463496796141932410325","282770784397242883421265679457259203442","246531610445563869144931801337895668299","15138475248557406236849728988410725024","147006916420222041370611371448050658037","210273853484005799120481782100937250227","176349274963678780310474767024050121400","218404584036008783808025732519204954311","142424273289479098595164973135647767409","245731252807577806810321165857500723770","276132803957739853615761959438342084446","17290598419729446084999452946523014363","63460410324017274335894406836835168408","273844251083326363050009551682752983712"]}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","target":{"file":"builtins/src/main/java/org/jline/builtins/PosixCommands.java"},"deprecated":false,"digest":{"line_hashes":["69539085325526020539623188769690878243","104759095995116257099553870118400787386","225274483165571419967060647710372636803","166892991884416697437928048181401533062","170795763391956511041102421412793359172","122569529698886728765609351623230499280","204431298514858500145766653998591189031","10540280951521438750151247979155831548","189279793232196136582239900040246737034","86598178884304387164785449416796185623","261447932358322192734086262847294718327","339100054709231144943640724027604572613","181160917946117924482702090169136750434","104330346372070974586328786817027840602","336446137665121700249389398461543928706","253273469553563809256984685583684525513","7490643149463113239729338465599353299","217793099223135913788504923435908092628","96140146609176453521839528163755403758","268388261280754409647422188503995499527","145291343730549992991753300159256277917","207391917465850862964534542108877797167","127586267909918281055457521130266114855","93299880370042073175368767877007840698","224337584606787699199106693750323939116","69576556569702247582174362995586493153","22332404349511883654311952031296177623"],"threshold":0.9},"id":"CVE-2026-77420-e276d3ac"},{"deprecated":false,"digest":{"line_hashes":["46470731455920273270260990044807756307","220503831867508928016256418847948763312","152092419726914094848241000474797983761","299752285509533324555188884716457030190"],"threshold":0.9},"id":"CVE-2026-77420-ea59a3eb","signature_type":"Line","signature_version":"v1","source":"https://github.com/jline/jline3/commit/6b83c24b6c3900f1c85d113dbeff23280e024f04","target":{"file":"shell/src/main/java/org/jline/shell/ExitShellException.java"}},{"signature_version":"v1","source":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","target":{"file":"builtins/src/main/java/org/jline/builtins/Less.java"},"deprecated":false,"digest":{"line_hashes":["211847395029071779537813525948676755845","229387202716380985349379298390493230900","213325916396492650593781291365340830841","98110787745695918911190647315211281820","302379449834329840962473715734785094957","181336586467390309758235877302890576593","63886566009641479150464737680700634969","128750563267022831767552352930540262106","302379449834329840962473715734785094957","181336586467390309758235877302890576593","63886566009641479150464737680700634969","128750563267022831767552352930540262106","67429498282413427552205201606880127615","45871482184594873974543727715945791034","272725369356223314561846406893078529706","119595900210303653043465144051341979303","129121147844741803832226940052127245563","284674342482881110905770582696962642309","172528078777003599006259052219646139432"],"threshold":0.9},"id":"CVE-2026-77420-ea9990e0","signature_type":"Line"},{"source":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","target":{"file":"builtins/src/main/java/org/jline/builtins/Less.java","function":"toBeDisplayed"},"deprecated":false,"digest":{"function_hash":"34855124013900986005707274451366841599","length":151},"id":"CVE-2026-77420-ef9a43f4","signature_type":"Function","signature_version":"v1"},{"target":{"file":"terminal/src/main/java/org/jline/utils/AttributedString.java"},"deprecated":false,"digest":{"line_hashes":["203854378939403555765425643276125628138","24048793074843594691811706887723650881","184030266740302065009997195874821403021","265559030407187319315157186242548973226","150248704267717115305799984274273544372","301254194913274245794171470890633811765","59430530834550440051987376890899549057","83727978563059905401567446034302678816","338736612975321702878174720568322191069","326121242655075064575344650820430110144","178109870896641267155906266909732672525","205442725283880667048542339839821370835","314368346461195710573831393554434548331"],"threshold":0.9},"id":"CVE-2026-77420-ef9ae579","signature_type":"Line","signature_version":"v1","source":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae"},{"id":"CVE-2026-77420-f6a809b2","signature_type":"Function","signature_version":"v1","source":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","target":{"file":"reader/src/main/java/org/jline/reader/impl/LineReaderImpl.java","function":"matches"},"deprecated":false,"digest":{"function_hash":"193711692779298097750448330594913746497","length":250}},{"source":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","target":{"file":"builtins/src/main/java/org/jline/builtins/Less.java","function":"moveToPreviousMatch"},"deprecated":false,"digest":{"function_hash":"98638218794382726970821803781098566540","length":830},"id":"CVE-2026-77420-fe40befc","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}