CVE-2026-56741: CWE-400: Uncontrolled Resource Consumption in jline jline3
JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
AI Analysis
Technical Summary
CVE-2026-56741 is an uncontrolled resource consumption vulnerability (CWE-400) in the JLine3 Telnet server remote-telnet module. The vulnerability arises because the TelnetIO.handleNAWS() method reads client-supplied terminal width and height as 16-bit unsigned integers without applying an upper bound, allowing values such as 65535x65535. An unauthenticated remote attacker can exploit this by repeatedly alternating these values, triggering continuous expensive rendering operations that exhaust CPU resources and cause denial of service. The vulnerability affects versions prior to 3.30.14, 4.0.16, and 4.2.1, where it has been fixed.
Potential Impact
An unauthenticated remote attacker can cause a denial of service by exhausting CPU resources through repeated manipulation of terminal dimensions in the Telnet NAWS option. This does not impact confidentiality or integrity but results in service unavailability.
Mitigation Recommendations
A fix is available in JLine3 versions 3.30.14, 4.0.16, and 4.2.1. Users should upgrade to these or later versions to remediate the vulnerability. Since this is a cloud service, the vendor typically manages remediation server-side; verify with the vendor advisory for confirmation.
CVE-2026-56741: CWE-400: Uncontrolled Resource Consumption in jline jline3
Description
JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
CVSS v3.1
Score 7.5high
Affected software
pkg:maven/org.jline/jline3Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-56741 is an uncontrolled resource consumption vulnerability (CWE-400) in the JLine3 Telnet server remote-telnet module. The vulnerability arises because the TelnetIO.handleNAWS() method reads client-supplied terminal width and height as 16-bit unsigned integers without applying an upper bound, allowing values such as 65535x65535. An unauthenticated remote attacker can exploit this by repeatedly alternating these values, triggering continuous expensive rendering operations that exhaust CPU resources and cause denial of service. The vulnerability affects versions prior to 3.30.14, 4.0.16, and 4.2.1, where it has been fixed.
Potential Impact
An unauthenticated remote attacker can cause a denial of service by exhausting CPU resources through repeated manipulation of terminal dimensions in the Telnet NAWS option. This does not impact confidentiality or integrity but results in service unavailability.
Mitigation Recommendations
A fix is available in JLine3 versions 3.30.14, 4.0.16, and 4.2.1. Users should upgrade to these or later versions to remediate the vulnerability. Since this is a cloud service, the vendor typically manages remediation server-side; verify with the vendor advisory for confirmation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-22T19:17:28.959Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 6a5b401b34329bf928c71911
Added to database: 07/18/2026, 08:58:03 UTC
Last enriched: 07/25/2026, 22:49:17 UTC
Last updated: 08/31/2026, 20:04:23 UTC
Views: 70
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.