A vulnerability in the JLine Java library allows authenticated users to trigger excessive CPU consumption, leading to a potential denial of service in applications utilizing the built-in nano editor.

The vulnerability exists in the doSearch method of the JLine nano editor, where user-supplied regex patterns are processed by the Java backtracking engine without constraints. This allows an authenticated user to submit a crafted nested-quantifier expression that forces the application into an indefinite CPU-intensive state, effectively consuming the worker thread assigned to that session.

The exploitation of this flaw can result in significant service degradation or total application unavailability, as each successful attack consumes a dedicated worker thread. While the CVSS score of 6.5 reflects a medium severity, the impact on multi-user environments can be severe if thread exhaustion leads to a complete service outage. This poses a risk to business continuity and operational stability for any platform relying on JLine for console-based input management.

Immediate Action: Update the JLine library to version 3.30.15 or 4.3.1 to incorporate the necessary regex timeout and backtracking bounds.

Proactive Monitoring: Monitor application logs and thread usage metrics for unusual spikes in CPU utilization or patterns of hung threads associated with the editor functionality.

Compensating Controls: If immediate patching is not feasible, restrict access to the affected nano editor interface to trusted users only and implement application-level thread monitoring to detect and terminate unresponsive sessions.

Public Exploit Available: Unknown (no confirmed public exploit or weaponized code found in available data).

Given that this vulnerability allows for resource exhaustion that could disrupt critical services, organizations should prioritize updating to the fixed versions of JLine. The ease of triggering this condition through standard user-controlled input makes it a notable stability risk for any Java-based application embedding the JLine library. Applying the update is the only definitive way to resolve the underlying regex processing flaw.