Back to overview

CVE-2026-56740

HIGH
7.5
CVSS 3.1
Description
JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

Metadata

CVE ID
CVE-2026-56740
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-06-22 19:17 UTC
Published
2026-07-17 21:17 UTC
Last updated
2026-07-17 21:17 UTC
Primary CWE
CWE-400
CWE-400: Uncontrolled Resource Consumption
Vendor / Product
jline / jline3
Sources
cve.org  ·  NVD

Severity & Metrics

7.5 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products (1)
VendorProductPlatformVersions
jline jline3 — < 3.30.14, >= 4.0.0, < 4.0.16, >= 4.1.0, < 4.2.1
Weakness (CWE)
CWESourceDescription
CWE-400 cna CWE-400: Uncontrolled Resource Consumption
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.5 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References (9)
Back to overview