Denial of Service Vulnerability in JLine Telnet Server
CVE-2026-56740
7.5HIGH
What is CVE-2026-56740?
The JLine Telnet server's remote-telnet module allows unauthenticated clients to exploit the Telnet NEW-ENVIRON option, enabling them to inject an unlimited number of environment variables. This can cause the Java Virtual Machine (JVM) to exhaust its heap memory, leading to an OutOfMemoryError. This vulnerability was addressed in versions 3.30.14, 4.0.16, and 4.2.1, which introduced limitations on the number of environment variables that can be injected.
Affected Version(s)
jline3 < 3.30.14 < 3.30.14
jline3 >= 4.0.0, < 4.0.16 < 4.0.0, 4.0.16
jline3 >= 4.1.0, < 4.2.1 < 4.1.0, 4.2.1