CVE-2026-56741: CWE-400: Uncontrolled Resource Consumption in jline jline3
JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
AI Analysis
Technical Summary
CVE-2026-56741 describes an uncontrolled resource consumption vulnerability (CWE-400) in the JLine3 Telnet server remote-telnet module. The vulnerability arises because the TelnetIO.handleNAWS() method reads client-supplied terminal width and height as 16-bit unsigned integers without applying an upper bound. Attackers can send large values such as 65535x65535 to setTerminalGeometry(), triggering continuous expensive rendering operations that exhaust CPU resources and cause denial of service. This vulnerability affects versions prior to 3.30.14, 4.0.16, and 4.2.1. The vulnerability is exploitable remotely without authentication. The vendor has released fixes in the specified versions.
Potential Impact
An unauthenticated remote attacker can exploit this vulnerability to cause CPU exhaustion on the affected system by sending specially crafted terminal dimension values via the Telnet NAWS option. This results in a denial of service condition, impacting availability. There is no impact on confidentiality or integrity according to the CVSS vector.
Mitigation Recommendations
A fix is available and has been released in JLine3 versions 3.30.14, 4.0.16, and 4.2.1. Users should upgrade to one of these fixed versions to remediate the vulnerability. Since this is a cloud service, the vendor manages remediation for the cloud-hosted service; users should verify with the vendor that their environment is updated accordingly.
CVE-2026-56741: CWE-400: Uncontrolled Resource Consumption in jline jline3
Description
JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
CVSS v3.1
Score 7.5high
Affected software
pkg:maven/org.jline/jline3Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-56741 describes an uncontrolled resource consumption vulnerability (CWE-400) in the JLine3 Telnet server remote-telnet module. The vulnerability arises because the TelnetIO.handleNAWS() method reads client-supplied terminal width and height as 16-bit unsigned integers without applying an upper bound. Attackers can send large values such as 65535x65535 to setTerminalGeometry(), triggering continuous expensive rendering operations that exhaust CPU resources and cause denial of service. This vulnerability affects versions prior to 3.30.14, 4.0.16, and 4.2.1. The vulnerability is exploitable remotely without authentication. The vendor has released fixes in the specified versions.
Potential Impact
An unauthenticated remote attacker can exploit this vulnerability to cause CPU exhaustion on the affected system by sending specially crafted terminal dimension values via the Telnet NAWS option. This results in a denial of service condition, impacting availability. There is no impact on confidentiality or integrity according to the CVSS vector.
Mitigation Recommendations
A fix is available and has been released in JLine3 versions 3.30.14, 4.0.16, and 4.2.1. Users should upgrade to one of these fixed versions to remediate the vulnerability. Since this is a cloud service, the vendor manages remediation for the cloud-hosted service; users should verify with the vendor that their environment is updated accordingly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-22T19:17:28.959Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 6a5b401b34329bf928c71911
Added to database: 07/18/2026, 08:58:03 UTC
Last enriched: 07/18/2026, 08:59:20 UTC
Last updated: 07/18/2026, 11:08:19 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.