Back to overview

CVE-2026-56741

HIGH
7.5
CVSS 3.1
Description
JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

Metadata

CVE ID
CVE-2026-56741
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-06-22 19:17 UTC
Published
2026-07-17 21:15 UTC
Last updated
2026-07-17 21:15 UTC
Primary CWE
CWE-400
CWE-400: Uncontrolled Resource Consumption
Vendor / Product
jline / jline3
Sources
cve.org  ·  NVD

Severity & Metrics

7.5 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products (1)
VendorProductPlatformVersions
jline jline3 — < 3.30.14, >= 4.0.0, < 4.0.16, >= 4.1.0, < 4.2.1
Weakness (CWE)
CWESourceDescription
CWE-400 cna CWE-400: Uncontrolled Resource Consumption
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.5 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References (7)
Back to overview