CVE-2026-56740

HIGH

JLine: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables

Title source: cna
STIX 2.1

Description

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

References (9)

Core 9
Core References
X_Refsource_Misc x_refsource_misc
https://github.com/jline/jline3/pull/2000
X_Refsource_Misc x_refsource_misc
https://github.com/jline/jline3/pull/2001
X_Refsource_Misc x_refsource_misc
https://github.com/jline/jline3/releases/tag/4.0.16
X_Refsource_Misc x_refsource_misc
https://github.com/jline/jline3/releases/tag/4.2.1

Scores

CVSS v3 7.5
EPSS 0.0050
EPSS Percentile 40.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-400
Status published
Products (4)
jline/jline3 < 3.30.14
jline/jline3 >= 4.0.0, < 4.0.16
jline/jline3 >= 4.1.0, < 4.2.1
org.jline/jline-remote-telnet 0 - 4.2.1Maven
Published Jul 17, 2026
Tracked Since Jul 18, 2026