JLine3 Telnet server memory exhaustion in remote-telnet module

Executive brief

The JLine3 Telnet server library is used by Java applications to provide remote command-line access. A vulnerability in how it handles connection setup allows an unauthenticated attacker to crash the server by sending a small amount of specially crafted network traffic. This results in a denial-of-service condition, potentially taking down the entire application and affecting all users.

Technical details

The JLine3 Telnet server's `remote-telnet` module fails to limit the number of environment variables a client can provide during the Telnet NEW-ENVIRON negotiation phase. Specifically, `TelnetIO.readNEVariables()` processes incoming variable pairs in a loop and stores them in an unbounded `HashMap` within `ConnectionData`. While individual variable names and values have size limits, the total count of variables does not. An unauthenticated remote attacker can send approximately 3-4 MB of traffic containing hundreds of thousands of unique variable pairs to exhaust the JVM heap (e.g., 512 MB), leading to an `OutOfMemoryError` and denial of service. This occurs before authentication is required. The issue is fixed in version 4.2.1.

Affected products

• jline3 jline-remote-telnet < 4.2.1

Timeline

• 2026-06-17: disclosed
• 2026-06-18: advisory: GitHub Advisory published
• 2026-06-18: patched: Version 4.2.1 released

References

• https://api.github.com/users/sectroyer
• https://github.com/sectroyer
• https://api.github.com/users/sectroyer/gists%7B/gist_id%7D
• https://api.github.com/users/sectroyer/repos
• https://avatars.githubusercontent.com/u/6706818?v=4
• https://api.github.com/users/sectroyer/events%7B/privacy%7D