PT-2026-60884 · Jline · Jline

CVE-2026-56740 · Published 2026-07-17 · Updated 2026-07-18

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions JLine versions prior to 3.30.14 JLine versions prior to 4.0.16 JLine versions prior to 4.2.1

Description The JLine3 Telnet server remote-telnet module fails to limit the number of environment variables a client can inject using the Telnet NEW-ENVIRON option. An unauthenticated attacker can flood unique variable pairs before the terminating IAC SE byte, which are then stored in a HashMap by the readNEVariables() function. This process can exhaust the JVM heap memory, leading to an OutOfMemoryError, a condition where the Java Virtual Machine cannot allocate more memory for objects.

Recommendations Update to version 3.30.14. Update to version 4.0.16. Update to version 4.2.1.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-56740

Affected Products

Jline

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2026-56740 · Security Note
• https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09 · Note
• https://github.com/jline/jline3/pull/2001 · Note
• https://github.com/jline/jline3/releases/tag/4.0.16 · Note
• https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194b · Note
• https://github.com/jline/jline3/pull/2000 · Note
• https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40 · Note
• https://github.com/jline/jline3/releases/tag/jline-3.30.14 · Note
• https://github.com/jline/jline3/releases/tag/4.2.1 · Note
• https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f · Note
• https://twitter.com/infoflowcloud/status/2078247351391498703 · Twitter Post
• https://twitter.com/CVEnew/status/2078246787119497354 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2078325749098934460 · Twitter Post