{"id":"CVE-2026-56740","summary":"JLine: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables","details":"JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.","aliases":["GHSA-47qp-hqvx-6r3f"],"modified":"2026-07-23T09:59:46.612750840Z","published":"2026-07-17T21:17:03.239Z","related":["CGA-fq9p-jrmm-c9x2","openSUSE-SU-2026:11338-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-400"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56740.json"},"references":[{"type":"WEB","url":"https://github.com/jline/jline3/releases/tag/4.0.16"},{"type":"WEB","url":"https://github.com/jline/jline3/releases/tag/4.2.1"},{"type":"WEB","url":"https://github.com/jline/jline3/releases/tag/jline-3.30.14"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56740.json"},{"type":"ADVISORY","url":"https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56740"},{"type":"FIX","url":"https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09"},{"type":"FIX","url":"https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40"},{"type":"FIX","url":"https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194b"},{"type":"FIX","url":"https://github.com/jline/jline3/pull/2000"},{"type":"FIX","url":"https://github.com/jline/jline3/pull/2001"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jline/jline3","events":[{"introduced":"0"},{"introduced":"e2422d778d98d935edd3d250a0d32b75a802c142"},{"introduced":"14e16662283d3942e04279115fae2dd2c7f77edb"},{"fixed":"c02dd469e463c83a1eed433a6565de12cc7234b0"},{"fixed":"86b7ba7801988aadb1a67555629522a71d603bd3"},{"fixed":"ee6981e7a8676dc2ffb5548c4527bf7e4b418ddb"},{"fixed":"0389f0ee6d0375901b602671ad5dafd4d1d4ee09"},{"fixed":"4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40"},{"fixed":"934f09e6128cee33c2b13d42b6e859c1ee2d194b"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.30.14"},{"introduced":"4.0.0"},{"fixed":"4.0.16"},{"introduced":"4.1.0"},{"fixed":"4.2.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["4.2.0","4.1.3","4.1.2","4.1.1","4.0.15","4.1.0","jline-3.30.13","4.0.14","jline-3.30.12","4.0.13","jline-3.30.11","jline-3.30.10","4.0.12","4.1.0-SNAPSHOT","4.0.11","4.0.10","4.0.9","4.0.8","4.0.7","jline-3.30.9","4.0.6","4.0.5","4.0.4","4.0.3","4.0.2","4.0.1","jline-3.30.8","4.0.0","jline-3.30.7","jline-3.30.6","jline-3.30.5","4.0.0-SNAPSHOT","jline-3.30.4","jline-3.30.3","jline-3.30.2","jline-3.30.1","jline-3.30.0","jline-3.29.0","jline-3.28.0","jline-3.27.1","jline-3.27.0","jline-parent-3.26.3","jline-parent-3.26.2","jline-parent-3.26.1","jline-parent-3.26.0","jline-parent-3.25.1","jline-parent-3.25.0","jline-parent-3.24.1","jline-parent-3.24.0","jline-parent-3.23.0","jline-parent-3.22.0","jline-parent-3.21.0","jline-parent-3.20.0","jline-parent-3.19.0","jline-parent-3.18.0","jline-parent-3.17.1","jline-parent-3.17.0","jline-parent-3.16.0","jline-parent-3.14.1","jline-parent-3.14.0","jline-parent-3.13.3","jline-parent-3.13.2","jline-parent-3.13.1","jline-parent-3.13.0","jline-parent-3.12.1","jline-parent-3.12.0","jline-parent-3.11.0","jline-parent-3.10.0","jline-parent-3.9.0","jline-parent-3.8.2","jline-parent-3.8.1","jline-parent-3.8.0","jline-parent-3.7.1","jline-parent-3.7.0","jline-parent-3.6.2","jline-parent-3.6.1","jline-parent-3.6.0","jline-parent-3.5.2","jline-parent-3.5.1","jline-parent-3.5.0","jline-parent-3.4.0","jline-3.3.1","jline-parent-3.3.0","jline-parent-3.2.0","jline-3.1.1","jline-3.1.0","jline-3.0.1","jline-3.0.0","jline-3.0.0.M2","jline-3.0.0.M1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56740.json","vanir_signatures_modified":"2026-07-22T08:04:25Z","vanir_signatures":[{"id":"CVE-2026-56740-05baba86","signature_type":"Function","signature_version":"v1","source":"https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40","target":{"file":"remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java","function":"readNEVariables"},"deprecated":false,"digest":{"length":1474,"function_hash":"9659067575893753802717095945310300604"}},{"source":"https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09","target":{"file":"remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java"},"deprecated":false,"digest":{"line_hashes":["114553106841320954481591867832549336960","252612839105147054231880134571793758531","283447327005235130799948611758560330175","62630067785711623491723545854880784477","177258765830403900940084317790318807210","116576334301746100171185812302241474861","129486502375561182486208346847798694875","252554145284528077034036932622068314126","119447324916635354966779118074940025716","68449694872116802040829898989487612640","76152990609906644015187505641628864299","318842209164117888817773013311510931037","254285511972821347395851233230491879827","315396873570121005309938374681341441154","305942254708714560704278022408065769543","190969554850831459262039945539883669452","213135248747880834674709502399209061058","119502526220449648074071543086322591867","333458897145637082651967716843097551618","226223177838734511668181214253325791428","35268129683398808192557976811372907612","89504487205750622351797002402111733211","178304634225702254318241383902381193877"],"threshold":0.9},"id":"CVE-2026-56740-40600949","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"18293505911945577055547336982745324144","length":1484},"id":"CVE-2026-56740-7cfd139e","signature_type":"Function","signature_version":"v1","source":"https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194b","target":{"function":"readNEVariables","file":"remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"9659067575893753802717095945310300604","length":1474},"id":"CVE-2026-56740-820c2de1","signature_type":"Function","signature_version":"v1","source":"https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09","target":{"file":"remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java","function":"readNEVariables"}},{"digest":{"line_hashes":["114553106841320954481591867832549336960","252612839105147054231880134571793758531","283447327005235130799948611758560330175","62630067785711623491723545854880784477","26131782598948083288601203857488271455","212194375308035009938747385810830404053","119502526220449648074071543086322591867","333458897145637082651967716843097551618","112679841775866632023851657384301624213","141996291166526693053120114535732079549","330965013841398701078877539099207484578","261354662018613459591414882692417150585"],"threshold":0.9},"id":"CVE-2026-56740-ae6eeaea","signature_type":"Line","signature_version":"v1","source":"https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194b","target":{"file":"remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40","target":{"file":"remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java","function":"setTerminalGeometry"},"deprecated":false,"digest":{"function_hash":"236413241627164877253365168930117531644","length":347},"id":"CVE-2026-56740-d70e878e","signature_type":"Function"},{"target":{"file":"remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["114553106841320954481591867832549336960","252612839105147054231880134571793758531","283447327005235130799948611758560330175","62630067785711623491723545854880784477","177258765830403900940084317790318807210","116576334301746100171185812302241474861","129486502375561182486208346847798694875","252554145284528077034036932622068314126","119447324916635354966779118074940025716","68449694872116802040829898989487612640","76152990609906644015187505641628864299","318842209164117888817773013311510931037","254285511972821347395851233230491879827","315396873570121005309938374681341441154","305942254708714560704278022408065769543","190969554850831459262039945539883669452","213135248747880834674709502399209061058","119502526220449648074071543086322591867","333458897145637082651967716843097551618","226223177838734511668181214253325791428","35268129683398808192557976811372907612","89504487205750622351797002402111733211","178304634225702254318241383902381193877"]},"id":"CVE-2026-56740-ea21c22f","signature_type":"Line","signature_version":"v1","source":"https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40"},{"source":"https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09","target":{"function":"setTerminalGeometry","file":"remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java"},"deprecated":false,"digest":{"function_hash":"236413241627164877253365168930117531644","length":347},"id":"CVE-2026-56740-ec9360e5","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}