The jline3 update to version 3.30.17 resolves several security issues: a native stack buffer overflow in the Public INPUT_RECORD.memmove JNI method on Windows (GHSA-6r3w-6jpj-x5w6), authenticated SSH shell channel resource leaks due to null or non-numeric PTY dimensions (GHSA-7h86-pjwh-gpqj), authenticated SSH denial-of-service via unbounded window-change terminal geometry (GHSA-m935-wqpj-pvp3), and TCP socket file descriptor leaks when maximum connections are reached (GHSA-c87g-867h-cqr6). The update also includes multiple bug fixes, security hardening, and dependency version bumps. SSH agent forwarding is no longer enabled by default, requiring explicit user action to enable. The update backports security fixes to the 3.x branch and addresses remaining vulnerabilities reported by AFINE/CERT.PL.

The vulnerabilities fixed include a native stack buffer overflow that could lead to memory corruption on Windows, resource leaks in authenticated SSH sessions potentially affecting system stability, denial-of-service conditions via terminal geometry manipulation, and TCP socket descriptor leaks that could exhaust system resources. These issues could degrade service availability or cause unexpected behavior in affected environments. No evidence of active exploitation is reported.

Users should update to jline3 version 3.30.17 or later to apply the security fixes and bug patches. The update disables SSH agent forwarding by default; users requiring this feature must explicitly enable it with the '-A' option. No additional mitigation steps are indicated by the vendor advisory.