Unauthenticated denial of service in JLine3 remote-telnet module (CVE-2026-56740)

CVE-2026-56740 is an unauthenticated remote denial-of-service vulnerability in the JLine3 remote-telnet module (org.jline:jline-remote-telnet). The function TelnetIO.readNEVariables() (TelnetIO.java:1127-1180) stores Telnet NEW-ENVIRON variable pairs in an unbounded HashMap with no per-connection count limit, allowing an unauthenticated attacker to exhaust JVM heap memory with an OutOfMemoryError by sending approximately 3-4 MB of network traffic prior to any login. Affected versions: - >= 4.0.0, < 4.2.1 - < 3.30.14 We recommend updating to: 3.30.14, 4.2.1. CVSS 7.5 · our assessment: this_week Vendor advisory: https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f Details: https://vuln.today/cve/CVE-2026-56740