Vulnerability-Lookup

CVE-2026-56740 (GCVE-0-2026-56740)

Vulnerability from cvelistv5 – Published: 2026-07-17 21:17 – Updated: 2026-07-20 13:58

Title

JLine: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables

Summary

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

GitHub_M

References

9 references

URL	Tags
https://github.com/jline/jline3/security/advisori…	x_refsource_CONFIRM
https://github.com/jline/jline3/pull/2000	x_refsource_MISC
https://github.com/jline/jline3/pull/2001	x_refsource_MISC
https://github.com/jline/jline3/commit/0389f0ee6d…	x_refsource_MISC
https://github.com/jline/jline3/commit/4ee3a73849…	x_refsource_MISC
https://github.com/jline/jline3/commit/934f09e612…	x_refsource_MISC
https://github.com/jline/jline3/releases/tag/4.0.16	x_refsource_MISC
https://github.com/jline/jline3/releases/tag/4.2.1	x_refsource_MISC
https://github.com/jline/jline3/releases/tag/jlin…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
jline	jline3	Affected: < 3.30.14 Affected: >= 4.0.0, < 4.0.16 Affected: >= 4.1.0, < 4.2.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56740",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-20T13:57:48.412665Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-20T13:58:00.902Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jline3",
          "vendor": "jline",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.30.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.1.0, \u003c 4.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-17T21:17:03.239Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f"
        },
        {
          "name": "https://github.com/jline/jline3/pull/2000",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/pull/2000"
        },
        {
          "name": "https://github.com/jline/jline3/pull/2001",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/pull/2001"
        },
        {
          "name": "https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09"
        },
        {
          "name": "https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40"
        },
        {
          "name": "https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194b"
        },
        {
          "name": "https://github.com/jline/jline3/releases/tag/4.0.16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/releases/tag/4.0.16"
        },
        {
          "name": "https://github.com/jline/jline3/releases/tag/4.2.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/releases/tag/4.2.1"
        },
        {
          "name": "https://github.com/jline/jline3/releases/tag/jline-3.30.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jline/jline3/releases/tag/jline-3.30.14"
        }
      ],
      "source": {
        "advisory": "GHSA-47qp-hqvx-6r3f",
        "discovery": "UNKNOWN"
      },
      "title": "JLine: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56740",
    "datePublished": "2026-07-17T21:17:03.239Z",
    "dateReserved": "2026-06-22T19:17:28.959Z",
    "dateUpdated": "2026-07-20T13:58:00.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-56740",
      "date": "2026-07-20",
      "epss": "0.00511",
      "percentile": "0.4025"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-56740\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-17T22:17:57.153\",\"lastModified\":\"2026-07-20T15:16:44.080\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"jline\",\"product\":\"jline3\",\"versions\":[{\"version\":\"\u003c 3.30.14\",\"status\":\"affected\"},{\"version\":\"\u003e= 4.0.0, \u003c 4.0.16\",\"status\":\"affected\"},{\"version\":\"\u003e= 4.1.0, \u003c 4.2.1\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-20T13:57:48.412665Z\",\"id\":\"CVE-2026-56740\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]}],\"references\":[{\"url\":\"https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194b\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jline/jline3/pull/2000\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jline/jline3/pull/2001\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jline/jline3/releases/tag/4.0.16\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jline/jline3/releases/tag/4.2.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jline/jline3/releases/tag/jline-3.30.14\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-56740\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-20T13:57:48.412665Z\"}}}], \"references\": [{\"url\": \"https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-20T13:57:28.578Z\"}}], \"cna\": {\"title\": \"JLine: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables\", \"source\": {\"advisory\": \"GHSA-47qp-hqvx-6r3f\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"jline\", \"product\": \"jline3\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.30.14\"}, {\"status\": \"affected\", \"version\": \"\u003e= 4.0.0, \u003c 4.0.16\"}, {\"status\": \"affected\", \"version\": \"\u003e= 4.1.0, \u003c 4.2.1\"}]}], \"references\": [{\"url\": \"https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f\", \"name\": \"https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/jline/jline3/pull/2000\", \"name\": \"https://github.com/jline/jline3/pull/2000\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/jline/jline3/pull/2001\", \"name\": \"https://github.com/jline/jline3/pull/2001\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09\", \"name\": \"https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40\", \"name\": \"https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194b\", \"name\": \"https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194b\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/jline/jline3/releases/tag/4.0.16\", \"name\": \"https://github.com/jline/jline3/releases/tag/4.0.16\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/jline/jline3/releases/tag/4.2.1\", \"name\": \"https://github.com/jline/jline3/releases/tag/4.2.1\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/jline/jline3/releases/tag/jline-3.30.14\", \"name\": \"https://github.com/jline/jline3/releases/tag/jline-3.30.14\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400: Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-17T21:17:03.239Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-56740\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-20T13:58:00.902Z\", \"dateReserved\": \"2026-06-22T19:17:28.959Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-17T21:17:03.239Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-56740

Vulnerability from fkie_nvd - Published: 2026-07-17 22:17 - Updated: 2026-07-20 15:16

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09
	security-advisories@github.com	https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40
	security-advisories@github.com	https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194b
	security-advisories@github.com	https://github.com/jline/jline3/pull/2000
	security-advisories@github.com	https://github.com/jline/jline3/pull/2001
	security-advisories@github.com	https://github.com/jline/jline3/releases/tag/4.0.16
	security-advisories@github.com	https://github.com/jline/jline3/releases/tag/4.2.1
	security-advisories@github.com	https://github.com/jline/jline3/releases/tag/jline-3.30.14
	security-advisories@github.com	https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "jline3",
          "vendor": "jline",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.30.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.1.0, \u003c 4.2.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1."
    }
  ],
  "id": "CVE-2026-56740",
  "lastModified": "2026-07-20T15:16:44.080",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-56740",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-20T13:57:48.412665Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-17T22:17:57.153",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194b"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jline/jline3/pull/2000"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jline/jline3/pull/2001"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jline/jline3/releases/tag/4.0.16"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jline/jline3/releases/tag/4.2.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jline/jline3/releases/tag/jline-3.30.14"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-47QP-HQVX-6R3F

Vulnerability from github – Published: 2026-06-18 13:07 – Updated: 2026-06-18 13:07

Summary

JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables

Details

Summary

The JLine3 Telnet server (remote-telnet module) does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option. An unauthenticated attacker can flood the server with a large number of unique variable pairs before sending the terminating IAC SE byte, exhausting JVM heap memory and causing an OutOfMemoryError (denial of service). Approximately 3–4 MB of network traffic is sufficient to consume a 512 MB JVM heap.

Details

TelnetIO.readNEVariables() (TelnetIO.java:1127-1180) processes incoming NEW-ENVIRON variable pairs in a loop and stores each pair in a HashMap held by ConnectionData:

// TelnetIO.java:1139-1178
boolean cont = true;
if (i == NE_VAR || i == NE_USERVAR) {
    do {
        switch (readNEVariableName(sbuf)) {
            case NE_VAR_OK:
                TelnetIO.this.connectionData.getEnvironment().put(str, sbuf.toString());
                // ← no per-connection count limit
                break;
            case NE_VAR_UNDEFINED:
                break; // cont remains true, loop continues
        }
    } while (cont);  // cont is never set to false; only exits via return
}

The variable accumulator map is a plain HashMap initialized with capacity 20 and no maximum size:

// ConnectionData.java:98
environment = new HashMap<String, String>(20);

Per-variable limits exist (name: max 50 chars, value: max 1000 chars), but there is no cap on the count of variables. Each map entry occupies approximately 2 KB of heap (String headers + Map.Entry + backing char arrays). On a JVM with a 512 MB heap, approximately 250,000 unique entries trigger an OutOfMemoryError.

Network cost: using sequential 1-byte names (e.g., \x01, \x02, ...) and 1-byte values, each variable pair requires roughly 13 protocol bytes. Sending 250,000 pairs requires only ~3.25 MB of network traffic — feasible in seconds over any reasonable network connection.

No authentication is required. NEW-ENVIRON negotiation occurs before login.

Affected source files: - remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java lines 1127-1180 - remote-telnet/src/main/java/org/jline/builtins/telnet/ConnectionData.java line 98

PoC

Connect to the JLine3 Telnet server and, after completing WILL/DO option negotiation, send a NEW-ENVIRON SEND subneg followed by a single large IS subneg containing thousands of unique variable pairs before the final IAC SE.

Protocol structure (no authentication required): 1. Standard Telnet option negotiation (IAC DO NEW-ENVIRON, IAC WILL NEW-ENVIRON) 2. Server sends IAC SB NEW-ENVIRON SEND IAC SE 3. Client responds with: IAC SB NEW-ENVIRON IS [NE_VAR 0x01 NE_VALUE 0x01] ← variable pair 1 [NE_VAR 0x02 NE_VALUE 0x01] ← variable pair 2 ... repeated N times ... IAC SE ← only sent after N pairs

Each iteration adds one entry to the per-connection environment map. The connection thread blocks reading from the socket while accumulating pairs, so the attacker controls the timing of the OOM.

Reproduction environment: - JLine3 built from current master on x86_64 Linux, OpenJDK 25.0.2 - remote-telnet module started with its default configuration - Confirmed by source-code analysis; loop exit condition and missing count guard verified by inspection of readNEVariables() and ConnectionData constructor

Impact

Type: Denial of Service (heap memory exhaustion / OutOfMemoryError) Who is affected: Any application embedding the JLine3 remote-telnet module and exposing its Telnet server. No credentials are required. A single connection can exhaust the entire JVM heap, crashing the host process or triggering JVM out-of-memory handling that impacts all users sharing that JVM instance.

Credits

This issue was identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jline:jline-remote-telnet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T13:07:25Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe JLine3 Telnet server (`remote-telnet` module) does not limit the number of\nenvironment variables a client may inject via the Telnet NEW-ENVIRON option. An\nunauthenticated attacker can flood the server with a large number of unique\nvariable pairs before sending the terminating IAC SE byte, exhausting JVM heap\nmemory and causing an OutOfMemoryError (denial of service). Approximately 3\u20134 MB of\nnetwork traffic is sufficient to consume a 512 MB JVM heap.\n\n### Details\n\n`TelnetIO.readNEVariables()` (TelnetIO.java:1127-1180) processes incoming NEW-ENVIRON\nvariable pairs in a loop and stores each pair in a `HashMap` held by `ConnectionData`:\n\n```java\n// TelnetIO.java:1139-1178\nboolean cont = true;\nif (i == NE_VAR || i == NE_USERVAR) {\n    do {\n        switch (readNEVariableName(sbuf)) {\n            case NE_VAR_OK:\n                TelnetIO.this.connectionData.getEnvironment().put(str, sbuf.toString());\n                // \u2190 no per-connection count limit\n                break;\n            case NE_VAR_UNDEFINED:\n                break; // cont remains true, loop continues\n        }\n    } while (cont);  // cont is never set to false; only exits via return\n}\n```\n\nThe variable accumulator map is a plain `HashMap` initialized with capacity 20 and\n**no maximum size**:\n\n```java\n// ConnectionData.java:98\nenvironment = new HashMap\u003cString, String\u003e(20);\n```\n\nPer-variable limits exist (name: max 50 chars, value: max 1000 chars), but there is no\ncap on the *count* of variables. Each map entry occupies approximately 2 KB of heap\n(String headers + `Map.Entry` + backing char arrays). On a JVM with a 512 MB heap,\napproximately 250,000 unique entries trigger an `OutOfMemoryError`.\n\nNetwork cost: using sequential 1-byte names (e.g., `\\x01`, `\\x02`, ...) and 1-byte\nvalues, each variable pair requires roughly 13 protocol bytes. Sending 250,000 pairs\nrequires only ~3.25 MB of network traffic \u2014 feasible in seconds over any reasonable\nnetwork connection.\n\nNo authentication is required. NEW-ENVIRON negotiation occurs before login.\n\nAffected source files:\n- `remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java` lines 1127-1180\n- `remote-telnet/src/main/java/org/jline/builtins/telnet/ConnectionData.java` line 98\n\n### PoC\n\nConnect to the JLine3 Telnet server and, after completing WILL/DO option negotiation,\nsend a NEW-ENVIRON SEND subneg followed by a single large IS subneg containing\nthousands of unique variable pairs before the final IAC SE.\n\nProtocol structure (no authentication required):\n1. Standard Telnet option negotiation (IAC DO NEW-ENVIRON, IAC WILL NEW-ENVIRON)\n2. Server sends IAC SB NEW-ENVIRON SEND IAC SE\n3. Client responds with: IAC SB NEW-ENVIRON IS\n     [NE_VAR 0x01 NE_VALUE 0x01]  \u2190 variable pair 1\n     [NE_VAR 0x02 NE_VALUE 0x01]  \u2190 variable pair 2\n     ... repeated N times ...\n     IAC SE                        \u2190 only sent after N pairs\n\nEach iteration adds one entry to the per-connection environment map. The connection\nthread blocks reading from the socket while accumulating pairs, so the attacker\ncontrols the timing of the OOM.\n\nReproduction environment:\n- JLine3 built from current master on x86_64 Linux, OpenJDK 25.0.2\n- `remote-telnet` module started with its default configuration\n- Confirmed by source-code analysis; loop exit condition and missing count guard\n  verified by inspection of `readNEVariables()` and `ConnectionData` constructor\n\n### Impact\n\n**Type**: Denial of Service (heap memory exhaustion / OutOfMemoryError)\n**Who is affected**: Any application embedding the JLine3 `remote-telnet` module and\nexposing its Telnet server. No credentials are required. A single connection can exhaust\nthe entire JVM heap, crashing the host process or triggering JVM out-of-memory\nhandling that impacts all users sharing that JVM instance.\n\n### Credits \n\nThis issue was identified by Micha\u0142 Majchrowicz and Marcin Wyczechowski, members of the AFINE Team.",
  "id": "GHSA-47qp-hqvx-6r3f",
  "modified": "2026-06-18T13:07:25Z",
  "published": "2026-06-18T13:07:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jline/jline3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables"
}

ubuntu-cve-2026-56740

Vulnerability from osv_ubuntu

Published

2026-07-20 00:00

Modified

2026-07-20 00:00

Summary

Details

(JLine is a Java library for handling console input. Prior to 3.30.14, ...)

Severity

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-56740	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-56740	REPORT
	https://github.com/jline/jline3/security/advisori…	REPORT
	https://github.com/jline/jline3/pull/2000	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjline-java",
            "binary_version": "1.0-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "jline",
        "purl": "pkg:deb/ubuntu/jline@1.0-2?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjline2-java",
            "binary_version": "2.11-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "jline2",
        "purl": "pkg:deb/ubuntu/jline2@2.11-2?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.11-1",
        "2.11-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjline-java",
            "binary_version": "1.0-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "jline",
        "purl": "pkg:deb/ubuntu/jline@1.0-2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjline2-java",
            "binary_version": "2.11-4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "jline2",
        "purl": "pkg:deb/ubuntu/jline2@2.11-4?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.11-4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjline-java",
            "binary_version": "1.0-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "jline",
        "purl": "pkg:deb/ubuntu/jline@1.0-2?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjline2-java",
            "binary_version": "2.14.6-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "jline2",
        "purl": "pkg:deb/ubuntu/jline2@2.14.6-1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.11-4",
        "2.12.1-1",
        "2.14.6-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjline-java",
            "binary_version": "1.0-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "jline",
        "purl": "pkg:deb/ubuntu/jline@1.0-2?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjline2-java",
            "binary_version": "2.14.6-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "jline2",
        "purl": "pkg:deb/ubuntu/jline2@2.14.6-3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.14.6-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjline-java",
            "binary_version": "1.0-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "jline",
        "purl": "pkg:deb/ubuntu/jline@1.0-3?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjline2-java",
            "binary_version": "2.14.6-4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "jline2",
        "purl": "pkg:deb/ubuntu/jline2@2.14.6-4?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.14.6-4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjline3-java",
            "binary_version": "3.3.1-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "jline3",
        "purl": "pkg:deb/ubuntu/jline3@3.3.1-2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.3.1-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjline-java",
            "binary_version": "1.0-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "jline",
        "purl": "pkg:deb/ubuntu/jline@1.0-3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjline2-java",
            "binary_version": "2.14.6-5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "jline2",
        "purl": "pkg:deb/ubuntu/jline2@2.14.6-5?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.14.6-5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjline3-java",
            "binary_version": "3.3.1-3ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "jline3",
        "purl": "pkg:deb/ubuntu/jline3@3.3.1-3ubuntu1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.3.1-3",
        "3.3.1-3ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjline-java",
            "binary_version": "1.0-3build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "jline",
        "purl": "pkg:deb/ubuntu/jline@1.0-3build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0-3",
        "1.0-3build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjline2-java",
            "binary_version": "2.14.6-6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "jline2",
        "purl": "pkg:deb/ubuntu/jline2@2.14.6-6?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.14.6-6"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjline3-java",
            "binary_version": "3.3.1-4build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "jline3",
        "purl": "pkg:deb/ubuntu/jline3@3.3.1-4build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.3.1-4",
        "3.3.1-4build1"
      ]
    }
  ],
  "aliases": [],
  "details": "(JLine is a Java library for handling console input. Prior to 3.30.14, ...)",
  "id": "UBUNTU-CVE-2026-56740",
  "modified": "2026-07-20T00:00:00Z",
  "published": "2026-07-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-56740"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56740"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/jline/jline3/pull/2000"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-56740"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-56740 (GCVE-0-2026-56740)

FKIE_CVE-2026-56740

GHSA-47QP-HQVX-6R3F

Summary

Details

PoC

Impact

Credits

ubuntu-cve-2026-56740

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature