CPU exhaustion via uncapped terminal dimensions in JLine3 (CVE-2026-56741)

The JLine3 remote-telnet module fails to enforce an upper bound on terminal dimensions received via the Telnet NAWS (Negotiate About Window Size) option. An unauthenticated remote attacker can send client-supplied width and height values up to 65535, alternating between values to continuously trigger expensive rendering work via WINCH signal propagation, resulting in CPU exhaustion and denial of service. Affected versions: - >= 4.0.0, < 4.2.1 - < 3.30.14 We recommend updating to: 3.30.14, 4.2.1. CVSS 7.5 · our assessment: this_week Vendor advisory: https://github.com/jline/jline3/security/advisories/GHSA-2r2c-cx56-8933 Details: https://vuln.today/cve/CVE-2026-56741