CVE-2026-56740

Name of the Vulnerable Software and Affected Versions JLine versions prior to 3.30.14 JLine versions prior to 4.0.16 JLine versions prior to 4.2.1

Description The JLine3 Telnet server remote-telnet module contains a flaw where it does not limit the number of environment variables a client can inject using the Telnet NEW-ENVIRON option. An unauthenticated attacker can flood the server with a large volume of unique variable pairs before sending the terminating IAC SE byte. These pairs are processed by the readNEVariables() function and stored in a HashMap within ConnectionData that has no maximum size. This can lead to the exhaustion of JVM heap memory, resulting in an OutOfMemoryError and a subsequent denial of service. It is estimated that approximately 3 to 4 MB of network traffic is sufficient to consume a 512 MB JVM heap.

Recommendations Update JLine to version 3.30.14 or later. Update JLine to version 4.0.16 or later. Update JLine to version 4.2.1 or later.