Affected: CleanStart: apache-nifi, CleanStart: apache-zookeeper, CleanStart: kafka

CVE-2026-77421 affects multiple packages. JLine is a Java library for handling console input. See references for individual vulnerability details.

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1.

Affected: Maven: org.jline:jline-builtins

### Summary

When regex search mode is enabled in the JLine3 `nano` editor, the user-supplied search term is compiled directly as a Java regular expression with no timeout or backtracking bound. A crafted pattern such as `(a+)+b` can hang the editor session thread at high CPU, causing a denial of service for that session.

### Details

In `builtins/src/main/java/org/jline/builtins/Nano.java`, the search implementation uses `Pattern.LITERAL` only when regex mode is disabled. When regex mode is enabled, the search term is compiled as a raw Java regex:

```java Pattern pat = Pattern.compile( searchTerm, (searchCaseSensitive ? 0 : Pattern.CASE_INSENSITIVE | Pattern.UNICODE_CASE) | (searchRegexp ? 0 : Pattern.LITERAL)); ```

This regex is then applied to buffer content. Because Java's regex engine is backtracking-based, nested-quantifier patterns can take exponential time on non-matching input.

Affected source location: - `builtins/src/main/java/org/jline/builtins/Nano.java` - `doSearch(String text)`

### PoC

1. Create a file containing a long run of `a` characters and open it in the JLine3 `nano` editor. 2. Enable regex search mode with the editor's regex toggle. 3. Start a search and enter the pattern `(a+)+b`.

Expected result: - The editor stops responding. - The session thread consumes high CPU.

Reproduction environment: - JLine3 on x86_64 Linux - OpenJDK 25.0.2

### Impact

This is a denial-of-service vulnerability caused by catastrophi…

Affected: Ubuntu:14.04:LTS: jline, Ubuntu:14.04:LTS: jline2, Ubuntu:16.04:LTS: jline, Ubuntu:16.04:LTS: jline2, Ubuntu:18.04:LTS: jline, Ubuntu:18.04:LTS: jline2, Ubuntu:20.04:LTS: jline, Ubuntu:20.04:LTS: jline2, Ubuntu:22.04:LTS: jline, Ubuntu:22.04:LTS: jline2 and 7 more

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1.