# CVE-2026-56740: JLine JLine3 denial of service in Telnet server NEW-ENVIRON handling

Source: https://junglewise.ai/threats/cve-2026-56740-jline-jline3-denial-of-service-in-telnet-server-new-environ  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-56740 · Severity: high · CVSS 7.5 · Published 2026-07-17

JLine is a Java library used by applications to handle command-line and console input. A vulnerability in its Telnet server component allows an unauthenticated remote attacker to crash the application by flooding it with a small amount of malicious network traffic. This results in a denial-of-service (DoS) condition, making the affected service unavailable to legitimate users.

Technologies: [JLine](https://junglewise.ai/threats/technologies/jline). Vendors: [JLine](https://junglewise.ai/threats/vendors/jline), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-56740 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56740 being exploited in the wild.

**How severe is CVE-2026-56740?** High severity, with a CVSS score of 7.5, published 17 July 2026.

**Which products and versions are affected?** JLine < 3.30.14, >= 4.0.0 < 4.0.16, >= 4.1.0 < 4.2.1; org.jline:jline-remote-telnet (Maven) ECOSYSTEM:introduced=4.1.0,fixed=4.2.1.

**Is there a fix for CVE-2026-56740?** Yes. org.jline:jline-remote-telnet (Maven): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56740 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56740?** Check whether you run JLine or org.jline:jline-remote-telnet (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.jline:jline-remote-telnet (Maven): upgrade to 4.2.1 or later

  ```sh
  # set org.jline:jline-remote-telnet to 4.2.1 in your pom.xml or build.gradle
  ```


## Technical details

A vulnerability exists in the JLine3 Telnet server's remote-telnet module due to uncontrolled resource consumption in the NEW-ENVIRON option handling. The TelnetIO.readNEVariables() method in TelnetIO.java fails to limit the number of environment variables a client can provide. An unauthenticated remote attacker can exploit this by sending approximately 3 MB of network traffic containing unique variable pairs, which are stored in a HashMap. This leads to an OutOfMemoryError and exhausts the JVM heap memory. The issue is resolved in versions 3.30.14, 4.0.16, and 4.2.1 by introducing a maximum variable count (NE_VAR_COUNT_MAX) of 100.

## Affected products

- jline jline3 < 3.30.14, >= 4.0.0 < 4.0.16, >= 4.1.0 < 4.2.1

## Identifiers

- CVE-2026-56740
- GHSA-47qp-hqvx-6r3f

## Timeline

- 2026-06-26: patched: Backport fixes merged for 3.x and 4.0.x branches
- 2026-07-17: disclosed: CVE published to NVD

## References

- [https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09](https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09)
- [https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40](https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40)
- [https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194b](https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194b)
- [https://github.com/jline/jline3/pull/2000](https://github.com/jline/jline3/pull/2000)
- [https://github.com/jline/jline3/pull/2001](https://github.com/jline/jline3/pull/2001)
- [https://github.com/jline/jline3/releases/tag/4.0.16](https://github.com/jline/jline3/releases/tag/4.0.16)
- [https://github.com/jline/jline3/releases/tag/4.2.1](https://github.com/jline/jline3/releases/tag/4.2.1)

## Related threats

- [JLine regular expression denial of service in less viewer](https://junglewise.ai/threats/cve-2026-77423-jline-is-a-java-library-for-handling-console-input-from-3-0-0)
- [JLine Nano editor ReDoS in regex search mode](https://junglewise.ai/threats/cve-2026-77421-jline-nano-editor-redos-in-regex-search-mode)
- [JLine HISTORY_IGNORE ReDoS via unescaped regex metacharacters](https://junglewise.ai/threats/cve-2026-77420-jline-history-ignore-redos-via-unescaped-regex-metacharacters)
- [JLine JLine3 denial of service in Telnet server NAWS handling](https://junglewise.ai/threats/cve-2026-56741-jline-jline3-denial-of-service-in-telnet-server-naws-handling)