CVE-2026-56741: JLine JLine3 denial of service in Telnet server NAWS handling

CVE-2026-56741 · Severity: high · CVSS 7.5 · Published 2026-07-17

JLine is a Java library used by applications to handle console input and terminal interactions. A vulnerability in its Telnet server component allows an unauthenticated remote attacker to crash or slow down the service by sending specially crafted terminal size instructions. This can lead to a denial of service, making the affected application unavailable to legitimate users.

Technologies: JLine. Vendors: JLine, Maven.

Quick answers

Is CVE-2026-56741 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56741 being exploited in the wild.
How severe is CVE-2026-56741?
High severity, with a CVSS score of 7.5, published 17 July 2026.
Which products and versions are affected?
JLine < 3.30.14, >= 4.0.0 < 4.0.16, >= 4.1.0 < 4.2.1; org.jline:jline-remote-telnet (Maven) ECOSYSTEM:introduced=4.1.0,fixed=4.2.1.
Is there a fix for CVE-2026-56741?
Yes. org.jline:jline-remote-telnet (Maven): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56741 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-56741?
Check whether you run JLine or org.jline:jline-remote-telnet (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.jline:jline-remote-telnet (Maven): upgrade to 4.2.1 or later
    # set org.jline:jline-remote-telnet to 4.2.1 in your pom.xml or build.gradle

Technical details

The JLine3 Telnet server's remote-telnet module fails to validate the upper bounds of terminal dimensions provided via the Telnet Negotiate About Window Size (NAWS) option. Specifically, TelnetIO.handleNAWS() in TelnetIO.java reads client-supplied width and height as 16-bit unsigned integers and passes values up to 65535x65535 to setTerminalGeometry(). An unauthenticated remote attacker can repeatedly alternate these large values to trigger continuous, computationally expensive rendering work (such as freshLine loops and columnSplitLength calculations), leading to CPU exhaustion and denial of service. The fix introduces upper bounds (LARGEST_BELIEVABLE_WIDTH/HEIGHT set to 500) and clamps exceeding values to defaults.

Affected products

  • jline jline3 < 3.30.14, >= 4.0.0 < 4.0.16, >= 4.1.0 < 4.2.1

Identifiers

  • CVE-2026-56741
  • GHSA-2r2c-cx56-8933

Timeline

  • 2026-06-26: patched: Fixes merged into 3.x and 4.0.x branches
  • 2026-07-17: disclosed: CVE-2026-56741 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.