CVE-2026-56740: JLine JLine3 denial of service in Telnet server NEW-ENVIRON handling

CVE-2026-56740 · Severity: high · CVSS 7.5 · Published 2026-07-17

JLine is a Java library used by applications to handle command-line and console input. A vulnerability in its Telnet server component allows an unauthenticated remote attacker to crash the application by flooding it with a small amount of malicious network traffic. This results in a denial-of-service (DoS) condition, making the affected service unavailable to legitimate users.

Technologies: JLine. Vendors: JLine, Maven.

Quick answers

Is CVE-2026-56740 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56740 being exploited in the wild.
How severe is CVE-2026-56740?
High severity, with a CVSS score of 7.5, published 17 July 2026.
Which products and versions are affected?
JLine < 3.30.14, >= 4.0.0 < 4.0.16, >= 4.1.0 < 4.2.1; org.jline:jline-remote-telnet (Maven) ECOSYSTEM:introduced=4.1.0,fixed=4.2.1.
Is there a fix for CVE-2026-56740?
Yes. org.jline:jline-remote-telnet (Maven): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56740 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-56740?
Check whether you run JLine or org.jline:jline-remote-telnet (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.jline:jline-remote-telnet (Maven): upgrade to 4.2.1 or later
    # set org.jline:jline-remote-telnet to 4.2.1 in your pom.xml or build.gradle

Technical details

A vulnerability exists in the JLine3 Telnet server's remote-telnet module due to uncontrolled resource consumption in the NEW-ENVIRON option handling. The TelnetIO.readNEVariables() method in TelnetIO.java fails to limit the number of environment variables a client can provide. An unauthenticated remote attacker can exploit this by sending approximately 3 MB of network traffic containing unique variable pairs, which are stored in a HashMap. This leads to an OutOfMemoryError and exhausts the JVM heap memory. The issue is resolved in versions 3.30.14, 4.0.16, and 4.2.1 by introducing a maximum variable count (NE_VAR_COUNT_MAX) of 100.

Affected products

  • jline jline3 < 3.30.14, >= 4.0.0 < 4.0.16, >= 4.1.0 < 4.2.1

Identifiers

  • CVE-2026-56740
  • GHSA-47qp-hqvx-6r3f

Timeline

  • 2026-06-26: patched: Backport fixes merged for 3.x and 4.0.x branches
  • 2026-07-17: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.