CVE-2026-56741

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/jline/jline3/commit/3ea9cad8699714dc072fade29d36be0d1e23d708	Patch
https://github.com/jline/jline3/commit/733eb353dca7b0ea0252e724445b6defa29c393e	Patch
https://github.com/jline/jline3/commit/86b7ba7801988aadb1a67555629522a71d603bd3	Patch
https://github.com/jline/jline3/pull/2000	Issue Tracking
https://github.com/jline/jline3/releases/tag/4.0.16	Release Notes
https://github.com/jline/jline3/releases/tag/4.2.1	Release Notes
https://github.com/jline/jline3/security/advisories/GHSA-2r2c-cx56-8933	Vendor Advisory Exploit
https://github.com/jline/jline3/security/advisories/GHSA-2r2c-cx56-8933	Vendor Advisory Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:jline:jline::::::::
	cpe:2.3:a:jline:jline::::::::
	cpe:2.3:a:jline:jline::::::::

History

No history.

Information

Published : 2026-07-17 22:17

Updated : 2026-08-18 15:17

NVD link : CVE-2026-56741

Mitre link : CVE-2026-56741

CVE.ORG link : CVE-2026-56741

JSON object : View

Products Affected

jline

jline

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-56741", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56741", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T15:21:00.621662Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "jline", "product": "jline3", "versions": [{"status": "affected", "version": "< 3.30.14"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.16"}, {"status": "affected", "version": ">= 4.1.0, < 4.2.1"}]}]}], "published": "2026-07-17T22:17:57.317", "references": [{"url": "https://github.com/jline/jline3/commit/3ea9cad8699714dc072fade29d36be0d1e23d708", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jline/jline3/commit/733eb353dca7b0ea0252e724445b6defa29c393e", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jline/jline3/commit/86b7ba7801988aadb1a67555629522a71d603bd3", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jline/jline3/pull/2000", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jline/jline3/releases/tag/4.0.16", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jline/jline3/releases/tag/4.2.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jline/jline3/security/advisories/GHSA-2r2c-cx56-8933", "tags": ["Vendor Advisory", "Exploit"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jline/jline3/security/advisories/GHSA-2r2c-cx56-8933", "tags": ["Vendor Advisory", "Exploit"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1."}], "lastModified": "2026-08-18T15:17:51.030", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jline:jline:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B951CA3-5A41-4A71-9C90-8377E53EC47A", "versionEndExcluding": "3.30.14"}, {"criteria": "cpe:2.3:a:jline:jline:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0949B9BC-A091-477A-B578-92C86B0E5DE8", "versionEndExcluding": "4.0.16", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:jline:jline:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6431F876-039C-4BE1-ABE0-4BFCC22B6F49", "versionEndExcluding": "4.2.1", "versionStartIncluding": "4.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}