AIKIDO-2026-898814

TL;DR

The built-in grep command in jline wraps an untrusted regular expression with .* on both sides, unless --line-regexp is set, and compiles that pattern with Java's backtracking regex engine. A short nested quantifier such as (a+)+b on a non-matching line makes the match consume CPU until the command thread stalls. A remote shell that exposes this command lets an unauthenticated user occupy a worker, and repeated sessions can exhaust the worker pool. The fix removes the .* wrapper, uses Matcher.find() for substring searches, and limits match time with SafeRegex.