CVE-2026-56741 Details
Description
JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
A denial-of-service vulnerability has been identified in the JLine library's remote-telnet module, affecting versions prior to 3.30.14, 4.0.16, and 4.2.1. The issue arises because the Telnet server does not impose an upper limit on terminal dimensions received through the Telnet NAWS option. This oversight allows an unauthenticated remote attacker to send exaggerated terminal size values, such as 65535x65535, which are then processed by the server. The exploitation of this vulnerability leads to excessive CPU usage and service disruption by causing the server to engage in resource-intensive rendering tasks.
Users can upgrade to JLine versions 3.30.14, 4.0.16, or 4.2.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| jline jline | < 3.30.14 >= 4.0.0, < 4.0.16 >= 4.1.0, < 4.2.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 18, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |