CVE-2026-56741

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-56741
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56741.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-56741
Aliases
Downstream
Published
2026-07-17T21:15:14.732Z
Modified
2026-07-21T03:41:49.558017520Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
JLine: Unauthenticated Remote DoS via Unbounded Telnet NAWS Terminal Geometry
Details

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56741.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400"
    ]
}
References

Affected packages

Git / github.com/jline/jline3

Affected ranges

Type
GIT
Repo
https://github.com/jline/jline3
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
e2422d778d98d935edd3d250a0d32b75a802c142
Introduced
14e16662283d3942e04279115fae2dd2c7f77edb
Fixed
c02dd469e463c83a1eed433a6565de12cc7234b0
Fixed
86b7ba7801988aadb1a67555629522a71d603bd3
Fixed
ee6981e7a8676dc2ffb5548c4527bf7e4b418ddb
Fixed
3ea9cad8699714dc072fade29d36be0d1e23d708
Fixed
733eb353dca7b0ea0252e724445b6defa29c393e
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.30.14"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.16"
        },
        {
            "introduced": "4.1.0"
        },
        {
            "fixed": "4.2.1"
        }
    ]
}

Affected versions

4.*
4.0.0
4.0.0-SNAPSHOT
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.15
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.0-SNAPSHOT
4.1.1
4.1.2
4.1.3
4.2.0
jline-3.*
jline-3.0.0
jline-3.0.0.M1
jline-3.0.0.M2
jline-3.0.1
jline-3.1.0
jline-3.1.1
jline-3.27.0
jline-3.27.1
jline-3.28.0
jline-3.29.0
jline-3.3.1
jline-3.30.0
jline-3.30.1
jline-3.30.10
jline-3.30.11
jline-3.30.12
jline-3.30.13
jline-3.30.2
jline-3.30.3
jline-3.30.4
jline-3.30.5
jline-3.30.6
jline-3.30.7
jline-3.30.8
jline-3.30.9
jline-parent-3.*
jline-parent-3.10.0
jline-parent-3.11.0
jline-parent-3.12.0
jline-parent-3.12.1
jline-parent-3.13.0
jline-parent-3.13.1
jline-parent-3.13.2
jline-parent-3.13.3
jline-parent-3.14.0
jline-parent-3.14.1
jline-parent-3.16.0
jline-parent-3.17.0
jline-parent-3.17.1
jline-parent-3.18.0
jline-parent-3.19.0
jline-parent-3.2.0
jline-parent-3.20.0
jline-parent-3.21.0
jline-parent-3.22.0
jline-parent-3.23.0
jline-parent-3.24.0
jline-parent-3.24.1
jline-parent-3.25.0
jline-parent-3.25.1
jline-parent-3.26.0
jline-parent-3.26.1
jline-parent-3.26.2
jline-parent-3.26.3
jline-parent-3.3.0
jline-parent-3.4.0
jline-parent-3.5.0
jline-parent-3.5.1
jline-parent-3.5.2
jline-parent-3.6.0
jline-parent-3.6.1
jline-parent-3.6.2
jline-parent-3.7.0
jline-parent-3.7.1
jline-parent-3.8.0
jline-parent-3.8.1
jline-parent-3.8.2
jline-parent-3.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56741.json"