High severity7.5NVD Advisory· Published Jul 17, 2026· Updated Aug 18, 2026
CVE-2026-56740
CVE-2026-56740
Description
JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.jline:jline-remote-telnetMaven | < 4.2.1 | 4.2.1 |
Affected products
44- osv-coords42 versionspkg:apk/chainguard/apache-camel-karavan-devmodepkg:apk/chainguard/apache-hoppkg:apk/chainguard/apache-hop-fipspkg:apk/chainguard/apache-nifi-toolkitpkg:apk/chainguard/apache-pulsar-4.0pkg:apk/chainguard/apache-pulsar-4.2pkg:apk/chainguard/apache-pulsar-fips-4.0pkg:apk/chainguard/apache-pulsar-fips-4.2pkg:apk/chainguard/confluent-kafkapkg:apk/chainguard/confluent-kafka-jre-bcfipspkg:apk/chainguard/druidpkg:apk/chainguard/hadoop-client-modulespkg:apk/chainguard/kafka-4.0pkg:apk/chainguard/kafka-4.1pkg:apk/chainguard/kafka-4.2pkg:apk/chainguard/kafka-4.3-openjdk-17pkg:apk/chainguard/kafka-4.3-openjdk-21pkg:apk/chainguard/kafka-4.3-openjdk-25pkg:apk/chainguard/kafka-fips-4.1pkg:apk/chainguard/kafka-fips-4.2pkg:apk/chainguard/kafka-fips-4.3pkg:apk/chainguard/pinotpkg:apk/chainguard/spark-fips-3.5-scala-2.12pkg:apk/chainguard/spark-fips-3.5-scala-2.13pkg:apk/chainguard/spark-kubernetes-operatorpkg:apk/chainguard/spark-kubernetes-operator-fipspkg:apk/chainguard/tezpkg:apk/chainguard/zookeeper-3.8pkg:apk/chainguard/zookeeper-3.9pkg:apk/chainguard/zookeeper-fips-3.8pkg:apk/chainguard/zookeeper-fips-3.9pkg:apk/wolfi/apache-nifi-toolkitpkg:apk/wolfi/apache-pulsar-4.2pkg:apk/wolfi/confluent-kafkapkg:apk/wolfi/druidpkg:apk/wolfi/kafka-4.0pkg:apk/wolfi/kafka-4.1pkg:apk/wolfi/kafka-4.2pkg:apk/wolfi/tezpkg:apk/wolfi/zookeeper-3.9pkg:rpm/opensuse/jline3&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/jline3&distro=openSUSE%20Tumbleweed
< 4.18.1-r5+ 41 more
- (no CPE)range: < 4.18.1-r5
- (no CPE)range: < 2.18.1-r1
- (no CPE)range: < 2.18.1-r1
- (no CPE)range: < 2.10.0-r1
- (no CPE)range: < 4.0.11-r3
- (no CPE)range: < 4.2.2-r4
- (no CPE)range: < 4.0.11-r3
- (no CPE)range: < 4.2.2-r2
- (no CPE)range: < 8.4.0.269-r1
- (no CPE)range: < 8.4.0.270-r1
- (no CPE)range: < 37.0.0-r14
- (no CPE)range: < 3.3.6-r13
- (no CPE)range: < 4.0.2-r3
- (no CPE)range: < 4.1.2-r3
- (no CPE)range: < 4.2.1-r3
- (no CPE)range: < 4.3.1-r1
- (no CPE)range: < 4.3.1-r1
- (no CPE)range: < 4.3.1-r1
- (no CPE)range: < 4.1.2-r4
- (no CPE)range: < 4.2.1-r2
- (no CPE)range: < 4.3.1-r3
- (no CPE)range: < 1.5.1-r1
- (no CPE)range: < 3.5.8-r4
- (no CPE)range: < 3.5.8-r4
- (no CPE)range: < 0.9.0-r2
- (no CPE)range: < 0.9.0-r2
- (no CPE)range: < 0.10.5-r19
- (no CPE)range: < 3.8.6-r7
- (no CPE)range: < 3.9.5-r8
- (no CPE)range: < 3.8.6-r7
- (no CPE)range: < 3.9.5-r5
- (no CPE)range: < 2.10.0-r1
- (no CPE)range: < 4.2.2-r4
- (no CPE)range: < 8.4.0.269-r1
- (no CPE)range: < 37.0.0-r14
- (no CPE)range: < 4.0.2-r3
- (no CPE)range: < 4.1.2-r3
- (no CPE)range: < 4.2.1-r3
- (no CPE)range: < 0.10.5-r19
- (no CPE)range: < 3.9.5-r8
- (no CPE)range: < 3.30.15-160000.1.1
- (no CPE)range: < 3.30.15-3.1
Patches
Vulnerability mechanics
References
11- github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09nvdPatchWEB
- github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40nvdPatchWEB
- github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194bnvdPatchWEB
- github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3fnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-47qp-hqvx-6r3fghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-56740ghsaADVISORY
- github.com/jline/jline3/pull/2000nvdIssue TrackingWEB
- github.com/jline/jline3/pull/2001nvdIssue TrackingWEB
- github.com/jline/jline3/releases/tag/4.0.16nvdRelease NotesWEB
- github.com/jline/jline3/releases/tag/4.2.1nvdRelease NotesWEB
- github.com/jline/jline3/releases/tag/jline-3.30.14nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.