Executive brief
JLine is a Java library used by applications to handle command-line and console input. A vulnerability in its Telnet server component allows an unauthenticated remote attacker to crash the application by flooding it with a small amount of malicious network traffic. This results in a denial-of-service (DoS) condition, making the affected service unavailable to legitimate users.
Technical details
A vulnerability exists in the JLine3 Telnet server's remote-telnet module due to uncontrolled resource consumption in the NEW-ENVIRON option handling. The TelnetIO.readNEVariables() method in TelnetIO.java fails to limit the number of environment variables a client can provide. An unauthenticated remote attacker can exploit this by sending approximately 3 MB of network traffic containing unique variable pairs, which are stored in a HashMap. This leads to an OutOfMemoryError and exhausts the JVM heap memory. The issue is resolved in versions 3.30.14, 4.0.16, and 4.2.1 by introducing a maximum variable count (NE_VAR_COUNT_MAX) of 100.
Affected products
- jline jline3 < 3.30.14, >= 4.0.0 < 4.0.16, >= 4.1.0 < 4.2.1
Timeline
- 2026-06-26: patched: Backport fixes merged for 3.x and 4.0.x branches
- 2026-07-17: disclosed: CVE published to NVD
References
- https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09
- https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40
- https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194b
- https://github.com/jline/jline3/pull/2000
- https://github.com/jline/jline3/pull/2001
- https://github.com/jline/jline3/releases/tag/4.0.16
- https://github.com/jline/jline3/releases/tag/4.2.1