CVE-2026-56740

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
jline	jline3	< 3.30.14; >= 4.0.0, < 4.0.16; >= 4.1.0, < 4.2.1

References

https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09Patch
https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40Patch
https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194bPatch
https://github.com/jline/jline3/pull/2000Issue Tracking
https://github.com/jline/jline3/pull/2001Issue Tracking
https://github.com/jline/jline3/releases/tag/4.0.16Release Notes
https://github.com/jline/jline3/releases/tag/4.2.1Release Notes
https://github.com/jline/jline3/releases/tag/jline-3.30.14Release Notes
https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3fExploit, Vendor Advisory
https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3fExploit, Vendor Advisory

Timeline

Published: Jul 17, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-567417.5JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does CVE-2026-567428.9Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow CVE-2026-567435.4Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CVE-2026-567448.7`@bsv/wallet-toolbox` provides BRC-100 wallet signing and storage components, while `@bsv/wallet-toolbox-client` and `@bsv/wallet-toolbox-mo CVE-2026-567457.5Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4 CVE-2026-567466.5Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.CVE-2026-567478.8Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated CVE-2026-567488.8Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker wi CVE-2026-56756.3A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown part of the file /borrowed_tool.php of CVE-2026-567509.1Gitea Remember-Me Token Theft Not Invalidating Attacker Session CVE-2026-567556.2Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload CVE-2026-567586.5The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the