JLine’s built‑in less viewer can accept user‑supplied search or display‑filter patterns that are forwarded directly to Java’s back‑tracking regular expression engine. A nested‑quantifier pattern that does not match selected lines can consume excessive CPU and block the session thread for an extended period. When the same vulnerable session is opened repeatedly through Telnet or SSH, the bounded worker pool can become exhausted, preventing new user sessions and effectively denying service to legitimate users. The weakness is a Regular Expression Denial of Service (CWE‑1333) and would allow an attacker to cause a denial of service by sending a specially crafted pattern to the less viewer search function.

The vulnerability affects the JLine library (artifact jline:jline3) versions from 3.0.0 through 3.30.15 and also the 4.3.1 release. These versions include the built‑in less viewer that accepts untrusted search patterns. Applications that incorporate JLine for terminal input—such as command‑line utilities and text editors running over SSH or Telnet—are susceptible if they use the less viewer feature without upgrading.

The CVSS score of 7.5 indicates a high severity denial‑of‑service risk. EPSS is not available, and the issue is not listed in the CISA KEV catalog, so public evidence of exploitation is not reported yet. However, the described attack path—submitting a malicious pattern through a terminal session—is feasible in any environment that accepts user input over Telnet, SSH, or local console access. The resulting CPU exhaustion or thread blockage can degrade availability for all users connected to the affected process, and in multi‑tenant deployments can lead to a full application outage.