The JLine library contains a regular expression denial of service issue in its built‑in nano editor. When a user supplies a regex search pattern to the editor, the library forwards that pattern to the Java regex engine without imposing any timeout or backtracking limit. A nested‑quantifier expression that does not match can trigger exponential backtracking, consuming CPU cycles and freezing the editor thread. The affected code path runs on the session thread, so in environments where the editor is used in the context of a remote terminal or multi‑user terminal session, an attacker can cause that thread to become permanently blocked, reducing the number of available sessions and degrading service availability. This flaw maps to CWE‑1333.

The flaw exists in all JLine releases from 3.0.0 through 3.30.14 and in 4.3.0. The public releases of 3.30.15 and 4.3.1 contain the patch that bounds the regex processing. Any application that embeds JLine and enables the nano editor’s regex search mode through its public API or interactive console is vulnerable. This includes command‑line tools, IDEs, or any services that expose a JLine front‑end.

The CVSS base score of 6.5 classifies the flaw as moderate severity. No EPSS score is published, so the likelihood of exploitation cannot be quantified, but the absence of a mitigation in the affected releases indicates that an attacker who can supply a crafted regex pattern can trigger the denial of service. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local or remote authenticated users that can supply input to the nano editor’s search functionality through a terminal session or application interface.