JLine, a Java library for console input handling, contains a regular‑expression denial‑of‑service vulnerability in its built‑in grep command. The command unwraps user‑supplied regexes by automatically adding a dot‑star prefix and suffix unless line‑regex mode is activated. This expansion can cause the Java backtracking regex engine to explore an exponential number of states when processing nested‑quantifier expressions, consuming excessive CPU cycles and blocking the command worker indefinitely. In remote shell sessions that expose the JLine grep functionality, this can lead to a denial of service, preventing further command execution.

Vendors affected include the JLine project (jline:jline3). The vulnerability exists in all releases from 3.0.0 up to 3.30.15 (exclusive) and any earlier 4.x release prior to 4.3.1. Versions 3.30.15 and 4.3.1 are fixed. Any Java application that incorporates the JLine library's built‑in grep command, such as console or shell interfaces, is potentially impacted.

The CVSS score of 7.5 indicates substantial severity, but no EPSS data are currently available, so the exact exploitation probability is unknown. The vulnerability has not been listed in the CISA KEV catalog. Exploitation requires an attacker to provide a crafted regex to the grep command; once invoked, the automatic dot‑star wrapping can cause severe CPU exhaustion. If an application exposes JLine’s shell interface to untrusted users, the attack vector is likely remote; otherwise it remains local. The denial of service impact is system‑wide for the affected process, as the command worker is blocked until the expression terminates or the process is killed.