PT-2026-60885 · Jline · Jline

CVE-2026-56741 · Published 2026-07-17 · Updated 2026-07-18

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions JLine versions prior to 3.30.14 JLine versions prior to 4.0.16 JLine versions prior to 4.2.1

Description The JLine3 Telnet server remote-telnet module fails to apply an upper bound to terminal dimensions received via the Telnet NAWS option. The handleNAWS() function in TelIO.java reads client-supplied width and height as 16-bit unsigned integers and passes these values to setTerminalGeometry(). An unauthenticated remote attacker can repeatedly alternate these values, such as 65535x65535, to trigger continuous expensive rendering work, leading to CPU exhaustion and a denial of service.

Recommendations Update to version 3.30.14 or later. Update to version 4.0.16 or later. Update to version 4.2.1 or later.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-56741

Affected Products

Jline

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-56741 · Security Note
• https://github.com/jline/jline3/commit/86b7ba7801988aadb1a67555629522a71d603bd3 · Note
• https://github.com/jline/jline3/releases/tag/4.0.16 · Note
• https://github.com/jline/jline3/pull/2000 · Note
• https://github.com/jline/jline3/commit/3ea9cad8699714dc072fade29d36be0d1e23d708 · Note
• https://github.com/jline/jline3/releases/tag/4.2.1 · Note
• https://github.com/jline/jline3/security/advisories/GHSA-2r2c-cx56-8933 · Note
• https://github.com/jline/jline3/commit/733eb353dca7b0ea0252e724445b6defa29c393e · Note
• https://twitter.com/VulmonFeeds/status/2078323188551844221 · Twitter Post
• https://twitter.com/CVEnew/status/2078246788814012743 · Twitter Post
• https://twitter.com/infoflowcloud/status/2078247380588048554 · Twitter Post