Executive brief
JLine is a Java library used by applications to handle console input and terminal interactions. A vulnerability in its Telnet server component allows an unauthenticated remote attacker to crash or slow down the service by sending specially crafted terminal size instructions. This can lead to a denial of service, making the affected application unavailable to legitimate users.
Technical details
The JLine3 Telnet server's remote-telnet module fails to validate the upper bounds of terminal dimensions provided via the Telnet Negotiate About Window Size (NAWS) option. Specifically, TelnetIO.handleNAWS() in TelnetIO.java reads client-supplied width and height as 16-bit unsigned integers and passes values up to 65535x65535 to setTerminalGeometry(). An unauthenticated remote attacker can repeatedly alternate these large values to trigger continuous, computationally expensive rendering work (such as freshLine loops and columnSplitLength calculations), leading to CPU exhaustion and denial of service. The fix introduces upper bounds (LARGEST_BELIEVABLE_WIDTH/HEIGHT set to 500) and clamps exceeding values to defaults.
Affected products
- jline jline3 < 3.30.14, >= 4.0.0 < 4.0.16, >= 4.1.0 < 4.2.1
Timeline
- 2026-06-26: patched: Fixes merged into 3.x and 4.0.x branches
- 2026-07-17: disclosed: CVE-2026-56741 published
References
- https://github.com/jline/jline3/commit/3ea9cad8699714dc072fade29d36be0d1e23d708
- https://github.com/jline/jline3/commit/733eb353dca7b0ea0252e724445b6defa29c393e
- https://github.com/jline/jline3/commit/86b7ba7801988aadb1a67555629522a71d603bd3
- https://github.com/jline/jline3/pull/2000
- https://github.com/jline/jline3/releases/tag/4.0.16
- https://github.com/jline/jline3/releases/tag/4.2.1
- https://github.com/jline/jline3/security/advisories/GHSA-2r2c-cx56-8933