CVE-2026-77421
MediumAdvisory
Published 23 Sept 2026In the index since 24 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.5
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 124
- of 17,837 indexed, latest versions
- Container images
- 107
- deployed by those charts
- Fix available
- 1 of 1
- affected package
JLine: ReDoS in Nano Editor Regex Search Mode
Carried by container images the latest versions of 124 of 17,837 indexed charts deploy, on 107 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jline-builtinsmaven | 3.8.2, 3.9.0, 3.12.1, 3.13.1+16 more | 3.30.15, 4.3.1 | 107 |
- OSV records
- GHSA-ph9c-7hw9-vhhw
Charts affected
124 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| kafka-helm-chartnotesprojectchart | 0.1.0 | 1 of 1See more | 4,579 |
| hive-metastoreolehrgfVerified publisher | 0.1.0 | 1 of 1See more | 8,571 |
| pulsarolehrgfVerified publisher | 0.0.5 | 1 of 2See more | 9,424 |
| onosopencord | 3.0.2 | 1 of 1See more | 13,044 |
| voltha-infraopencord | 2.14.0 | 1 of 10See more | 41,446 |
| sentinelopennms-helm-chartsVerified publisher | 0.4.0 | 1 of 2See more | 2,163 |
| dfdeweyosdfir-infrastructureVerified publisher | 1.0.0 | 1 of 3See more | 1,303 |
| osdfir-infrastructureosdfir-infrastructureVerified publisher | 2.15.0 | 1 of 40See more | 201,333 |
| timesketchosdfir-infrastructureVerified publisher | 1.0.8 | 1 of 6See more | 1,300 |
| punchline-javapunchplatform | 8.1.1 | 1 of 1See more | 2,021 |
| kafkaquench-kafkaVerified publisher | 0.0.17 | 1 of 1See more | 33 |
| opensearchquench-opensearchVerified publisher | 0.1.6 | 1 of 1See more | 33 |
| pulsarquench-pulsarVerified publisher | 0.0.18 | 1 of 1See more | 59 |
| zookeeperquench-zookeeperVerified publisher | 0.0.15 | 1 of 1See more | 33 |
| radar-cp-ksql-serverradar-baseVerified publisher | 0.0.2 | 1 of 2See more | 5,427 |
| sonatype-nexus3simcube | 1.0.1 | 1 of 2See more | 4,869 |
| stewardsoftwaremillVerified publisher | 0.1.12 | 1 of 1See more | 428 |
| trinostatcan | 1.23.4 | 1 of 2See more | 14,024 |
| hadoop-deploymenttejaswita-hadoop-helmchart | 1.0.0 | 1 of 1See more | 4,265 |
| kafkatwomartensVerified publisher | 0.2.1 | 1 of 2See more | 1,271 |
| zookeepertwomartensVerified publisher | 0.2.2 | 1 of 1See more | 1,781 |
| wazuhwazuh-helm-eksVerified publisher | 1.2.10 | 1 of 6See more | 5,648 |
| drillwearefrank | 1.3.6 | 1 of 3See more | 9,469 |
| ygdrassil-monitoringygdrassilVerified publisher | 0.4.0 | 1 of 10See more | 9,550 |
Container images carrying it
107 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| confluentinc/ | ee403d5b9090 | jline-builtins | 3.30.15 | 1 |
| confluentinc/ | 0bec03c1f3ce | jline-builtins | 3.30.15 | 1 |
| confluentinc/ | 5ca5f3269814 | jline-builtins | 3.30.15 | 1 |
| confluentinc/ | 1a3266adff1a | jline-builtins | 3.30.15 | 1 |
| dremio/ | 80ed2e3b7c43 | jline-builtins | 3.30.15 | 1 |
| fthomas/ | a8eb43927576 | jline-builtins | 3.30.15 | 1 |
| gchq/ | c460bb587d6d | jline-builtins | 3.30.15 | 1 |
| graylog/ | 8a1f641cd7aa | jline-builtins | 3.30.15 | 1 |
| gridgain/ | 95018390077b | jline-builtins | 3.30.15 | 1 |
| hazelcast/ | a825ecbe9fda | jline-builtins | 3.30.15 | 1 |
| hivemq/ | 4d194450d48e | jline-builtins | 3.30.15 | 1 |
| kafkace/ | 7adc206bf5a4 | jline-builtins | 3.30.15 | 1 |
| kafkakraft/ | 062d697db7e5 | jline-builtins | 3.30.15 | 1 |
| kafkakraft/ | f261ad288fce | jline-builtins | 3.30.15 | 1 |
| kafkakraft/ | 2e4b593b878b | jline-builtins | 3.30.15 | 1 |
| magento/ | 59fb6f0f1461 | jline-builtins | 3.30.15 | 1 |
| microslac/ | a90091a1f524 | jline-builtins | 3.30.15 | 1 |
| onosproject/ | 44914a8d4b3f | jline-builtins | 3.30.15 | 1 |
| openhab/ | bfd4a60e90da | jline-builtins | 3.30.15 | 1 |
| openhab/ | d0aa4af452c1 | jline-builtins | 3.30.15 | 1 |
| opennms/ | 88869082a14f | jline-builtins | 3.30.15 | 1 |
| opensearchproject/ | 57c25fa01d3c | jline-builtins | 3.30.15 | 1 |
| opensearchproject/ | 1963b3ece46d | jline-builtins | 3.30.15 | 1 |
| opensearchproject/ | 466a49f379bb | jline-builtins | 3.30.15 | 1 |
| opensearchproject/ | 474ea3fdf25d | jline-builtins | 3.30.15 | 1 |
| opensearchproject/ | 645d3d9390ad | jline-builtins | 3.30.15 | 1 |
| opensearchproject/ | 69588c664014 | jline-builtins | 3.30.15 | 1 |
| opensearchproject/ | 798cf28e226a | jline-builtins | 3.30.15 | 1 |
| opensearchproject/ | c8f3ebd2a934 | jline-builtins | 3.30.15 | 1 |
| opensearchproject/ | e321cb03c643 | jline-builtins | 3.30.15 | 1 |
| payara/ | fb44b8ce1cb2 | jline-builtins | 3.30.15 | 1 |
| payara/ | 31f1253f0cf8 | jline-builtins | 3.30.15 | 1 |
| soldevelo/ | cfdc08c2f577 | jline-builtins | 3.30.15 | 1 |
| sonatype/ | 4bd975493104 | jline-builtins | 3.30.15 | 1 |
| sonatype/ | 586060431b64 | jline-builtins | 3.30.15 | 1 |
| strangebee/ | a7f7b05fba24 | jline-builtins | 3.30.15 | 1 |
| tchiotludo/ | c2824dc2ae44 | jline-builtins | 3.30.15 | 1 |
| trinodb/ | ee80ab5eeab2 | jline-builtins | 3.30.15 | 1 |
| voltha/ | e038acb950d3 | jline-builtins | 3.30.15 | 1 |
| wazuh/ | 9c344d2b1757 | jline-builtins | 3.30.15 | 1 |
| wazuh/ | a7a2076b167e | jline-builtins | 3.30.15 | 1 |
| wazuh/ | b149b30da686 | jline-builtins | 3.30.15 | 1 |
| ghcr.io/ | 4a2824296412 | jline-builtins | 3.30.15 | 1 |
| ghcr.io/ | ac62269785ac | jline-builtins | 3.30.15 | 1 |
| ghcr.io/ | 8caf5289fe73 | jline-builtins | 3.30.15 | 1 |
| ghcr.io/ | 865ff4da5686 | jline-builtins | 3.30.15 | 1 |
| ghcr.io/ | 43e1085cd0a8 | jline-builtins | 3.30.15 | 1 |
| ghcr.io/ | e949b0f733f0 | jline-builtins | 3.30.15 | 1 |
| ghcr.io/ | 071a788162e8 | jline-builtins | 3.30.15 | 1 |
| ghcr.io/ | 4402ba7fd544 | jline-builtins | 3.30.15 | 1 |