CVE-2026-56740

HighCVSS 7.5

Published: 17/07/2026(UTC)Updated: 18/08/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

41th percentile - higher than 41% of all known CVEs

Summary

JLine is a Java library for console handling. Prior to versions 3.30.14, 4.0.16, and 4.2.1, the Telnet module does not limit the number of environment variables a client can inject. An unauthenticated attacker can send many unique variable pairs, causing JVM heap memory exhaustion and an OutOfMemoryError.

Risk Assessment

An attacker can cause a denial of service (DoS) by exhausting memory, preventing the application using the JLine Telnet server from functioning.

Recommendation

Upgrade JLine to version 3.30.14, 4.0.16, or 4.2.1 (depending on the branch used), which include a fix limiting the number of environment variables.

Other vulnerabilities in JLine

CVE-2026-56741High
JLine, a Java library for console input, contains a vulnerability in the Telnet server remote-telnet module. The TelnetIO.handleNAWS() function does not limit terminal dimensions received from the client, allowing an unauthenticated attacker to repeatedly set large values (e.g., 65535x65535), causing intensive rendering calculations and CPU exhaustion (DoS).

Original NVD description (English source)

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.