JLine is a Java library that manages console input. A flaw in the DefaultHistory.matchPatterns function allows the HISTORY_IGNORE configuration value to be converted into a Java regular expression with incomplete escaping. An attacker who can control the configuration can supply a nested‑quantifier regex. Each time a command is added to history, the malformed expression triggers catastrophic backtracking, consuming excessive CPU resources and indefinitely blocking the reader thread, resulting in a denial‑of‑service condition.

The vulnerability exists in the JLine library for versions from 3.0.0 up to but excluding 3.30.15 and any 4.x series before 4.3.1. Users running any of these releases on Java applications that load user or application configuration are affected.

The CVSS score of 5.5 indicates moderate risk. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog, suggesting no immediately known widespread exploitation. The attack vector requires the adversary to influence the configuration or user‑supplied HISTORY_IGNORE setting; once active, the flaw causes resource exhaustion via regular expression backtracking. While it does not grant code execution, it can disable interactive console input, effectively denying service to the affected user or application.