JLine JLine3 remote-telnet denial of service via unbounded NAWS terminal geometry

Executive brief

A vulnerability in the JLine3 Telnet server component allows an unauthenticated attacker to crash or slow down the server by sending specially crafted network packets. By repeatedly requesting extremely large terminal window sizes, an attacker can force the server to perform excessive calculations, leading to high CPU usage and a denial of service. This affects any application using the JLine3 remote-telnet module, potentially disrupting operations and preventing legitimate users from connecting.

Technical details

The JLine3 Telnet server's `remote-telnet` module fails to enforce an upper bound on terminal dimensions provided via the Telnet Negotiate About Window Size (NAWS) option. An unauthenticated remote attacker can send NAWS subnegotiation packets advertising maximum terminal dimensions (65535x65535). Because the server triggers a `WINCH` signal and subsequent `redisplay()` call upon geometry changes, an attacker alternating between two large values can force the server into continuous, computationally expensive rendering cycles. This results in CPU exhaustion and denial of service. The issue is fixed in version 4.2.1.

Affected products

• jline jline3 < 4.2.1

Timeline

• 2026-06-17: disclosed
• 2026-06-18: advisory
• 2026-06-18: patched: Version 4.2.1 released

References

• https://api.github.com/users/sectroyer
• https://github.com/sectroyer
• https://api.github.com/users/sectroyer/gists%7B/gist_id%7D
• https://api.github.com/users/sectroyer/repos
• https://avatars.githubusercontent.com/u/6706818?v=4
• https://api.github.com/users/sectroyer/events%7B/privacy%7D