Junglewise Threat Intelligence

CVE-2026-56740: JLine JLine3 denial of service in Telnet server NEW-ENVIRON handling

CVE-2026-56740 · Severity: high · CVSS 7.5 · Published 2026-07-17

Executive brief

JLine is a Java library used by applications to handle command-line and console input. A vulnerability in its Telnet server component allows an unauthenticated remote attacker to crash the application by flooding it with a small amount of malicious network traffic. This results in a denial-of-service (DoS) condition, making the affected service unavailable to legitimate users.

Technical details

A vulnerability exists in the JLine3 Telnet server's remote-telnet module due to uncontrolled resource consumption in the NEW-ENVIRON option handling. The TelnetIO.readNEVariables() method in TelnetIO.java fails to limit the number of environment variables a client can provide. An unauthenticated remote attacker can exploit this by sending approximately 3 MB of network traffic containing unique variable pairs, which are stored in a HashMap. This leads to an OutOfMemoryError and exhausts the JVM heap memory. The issue is resolved in versions 3.30.14, 4.0.16, and 4.2.1 by introducing a maximum variable count (NE_VAR_COUNT_MAX) of 100.

Affected products

  • jline jline3 < 3.30.14, >= 4.0.0 < 4.0.16, >= 4.1.0 < 4.2.1

Timeline

  • 2026-06-26: patched: Backport fixes merged for 3.x and 4.0.x branches
  • 2026-07-17: disclosed: CVE published to NVD

References

Related threats