Vulnerabilities in pkg:maven/org.jline/jline-remote-telnet

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-47qp-hqvx-6r3f",
  "modified" : "2026-09-01T21:03:11Z",
  "published" : "2026-06-18T13:07:25Z",
  "aliases" : [ "CVE-2026-56740" ],
  "summary" : "JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables",
  "details" : "### Summary\n\nThe JLine3 Telnet server (`remote-telnet` module) does not limit the number of\nenvironment variables a client may inject via the Telnet NEW-ENVIRON option. An\nunauthenticated attacker can flood the server with a large number of unique\nvariable pairs before sending the terminating IAC SE byte, exhausting JVM heap\nmemory and causing an OutOfMemoryError (denial of service). Approximately 3–4 MB of\nnetwork traffic is sufficient to consume a 512 MB JVM heap.\n\n### Details\n\n`TelnetIO.readNEVariables()` (TelnetIO.java:1127-1180) processes incoming NEW-ENVIRON\nvariable pairs in a loop and stores each pair in a `HashMap` held by `ConnectionData`:\n\n```java\n// TelnetIO.java:1139-1178\nboolean cont = true;\nif (i == NE_VAR || i == NE_USERVAR) {\n    do {\n        switch (readNEVariableName(sbuf)) {\n            case NE_VAR_OK:\n                TelnetIO.this.connectionData.getEnvironment().put(str, sbuf.toString());\n                // ← no per-connection count limit\n                break;\n            case NE_VAR_UNDEFINED:\n                break; // cont remains true, loop continues\n        }\n    } while (cont);  // cont is never set to false; only exits via return\n}\n```\n\nThe variable accumulator map is a plain `HashMap` initialized with capacity 20 and\n**no maximum size**:\n\n```java\n// ConnectionData.java:98\nenvironment = new HashMap<String, String>(20);\n```\n\nPer-variable limits exist (name: max 50 chars, value: max 1000 chars), but there is no\ncap on the *count* of variables. Each map entry occupies approximately 2 KB of heap\n(String headers + `Map.Entry` + backing char arrays). On a JVM with a 512 MB heap,\napproximately 250,000 unique entries trigger an `OutOfMemoryError`.\n\nNetwork cost: using sequential 1-byte names (e.g., `\\x01`, `\\x02`, ...) and 1-byte\nvalues, each variable pair requires roughly 13 protocol bytes. Sending 250,000 pairs\nrequires only ~3.25 MB of network traffic — feasible in seconds over any reasonable\nnetwork connection.\n\nNo authentication is required. NEW-ENVIRON negotiation occurs before login.\n\nAffected source files:\n- `remote-telnet/src/main/java/org/jline/builtins/telnet/TelnetIO.java` lines 1127-1180\n- `remote-telnet/src/main/java/org/jline/builtins/telnet/ConnectionData.java` line 98\n\n### PoC\n\nConnect to the JLine3 Telnet server and, after completing WILL/DO option negotiation,\nsend a NEW-ENVIRON SEND subneg followed by a single large IS subneg containing\nthousands of unique variable pairs before the final IAC SE.\n\nProtocol structure (no authentication required):\n1. Standard Telnet option negotiation (IAC DO NEW-ENVIRON, IAC WILL NEW-ENVIRON)\n2. Server sends IAC SB NEW-ENVIRON SEND IAC SE\n3. Client responds with: IAC SB NEW-ENVIRON IS\n     [NE_VAR 0x01 NE_VALUE 0x01]  ← variable pair 1\n     [NE_VAR 0x02 NE_VALUE 0x01]  ← variable pair 2\n     ... repeated N times ...\n     IAC SE                        ← only sent after N pairs\n\nEach iteration adds one entry to the per-connection environment map. The connection\nthread blocks reading from the socket while accumulating pairs, so the attacker\ncontrols the timing of the OOM.\n\nReproduction environment:\n- JLine3 built from current master on x86_64 Linux, OpenJDK 25.0.2\n- `remote-telnet` module started with its default configuration\n- Confirmed by source-code analysis; loop exit condition and missing count guard\n  verified by inspection of `readNEVariables()` and `ConnectionData` constructor\n\n### Impact\n\n**Type**: Denial of Service (heap memory exhaustion / OutOfMemoryError)\n**Who is affected**: Any application embedding the JLine3 `remote-telnet` module and\nexposing its Telnet server. No credentials are required. A single connection can exhaust\nthe entire JVM heap, crashing the host process or triggering JVM out-of-memory\nhandling that impacts all users sharing that JVM instance.\n\n### Credits \n\nThis issue was identified by Michał Majchrowicz and Marcin Wyczechowski, members of the AFINE Team.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.jline:jline-remote-telnet"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.1.0"
      }, {
        "fixed" : "4.2.1"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.jline:jline-remote-telnet"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.0"
      }, {
        "fixed" : "4.0.16"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.jline:jline-remote-telnet"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.30.14"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-56740"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jline/jline3/pull/2000"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jline/jline3/pull/2001"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jline/jline3/commit/0389f0ee6d0375901b602671ad5dafd4d1d4ee09"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jline/jline3/commit/4ee3a73849ffb9a85ec748e4e8cd8f6d81f84f40"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jline/jline3/commit/934f09e6128cee33c2b13d42b6e859c1ee2d194b"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/jline/jline3"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jline/jline3/releases/tag/4.0.16"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jline/jline3/releases/tag/4.2.1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jline/jline3/releases/tag/jline-3.30.14"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-18T13:07:25Z",
    "nvd_published_at" : "2026-07-17T22:17:57Z"
  }
}