What is the CVSS score of CVE-2026-56740?

CVE-2026-56740 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of JLine3 are affected by CVE-2026-56740?

JLine3 remote-telnet server module versions before 3.30.14, 4.0.16, and 4.2.1 are vulnerable to unauthenticated remote denial-of-service attacks that crash the Java Virtual Machine, impacting…. A patch is available.

Is there a public PoC exploit available for CVE-2026-56740?

Yes, a public proof-of-concept exploit is available for CVE-2026-56740. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-56740?

Within 24 hours: inventory systems running vulnerable JLine3 versions (prior to 3.30.14, 4.0.16, and 4.2.1) and determine whether the remote-telnet module is active in production. Within 7 days: implement network-level mitigations such as firewall rules restricting telnet access to trusted internal hosts, rate limiting on telnet connection attempts, or disabling the telnet service entirely if not operationally required. Within 30 days: plan and execute an upgrade to JLine3 version 3.30.14, 4.0.16, 4.2.1, or later depending on your current version track, or migrate to alternative libraries if telnet support is no longer needed.

JLine3 CVE-2026-56740

EUVD-2026-45343 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-17 GitHub_M

GHSA-47qp-hqvx-6r3f

Denial Of Service Java Red Hat Jline Jline3

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Pre-auth network-reachable NEW-ENVIRON parsing (AV:N/PR:N/UI:N) with trivially automatable heap flooding (AC:L) yielding a crash only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 17, 2026 - 23:19 EUVD

Source Code Evidence Fetched

Jul 17, 2026 - 22:01 vuln.today

Analysis Generated

Jul 17, 2026 - 22:01 vuln.today

CVE Published

Jul 17, 2026 - 21:17 cve.org

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on org.jline:jline-remote-telnet (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.1.0.

DescriptionCVE.org

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

AnalysisAI

Unauthenticated remote denial of service in the JLine3 remote-telnet server module (versions before 3.30.14, 4.0.16, and 4.2.1) lets an attacker crash the JVM by flooding the Telnet NEW-ENVIRON negotiation with unbounded unique environment-variable pairs. Because TelnetIO.readNEVariables() stores every pair in an uncapped HashMap on ConnectionData before login, roughly 3-4 MB of traffic can exhaust a 512 MB heap and force an OutOfMemoryError. No public exploit code is identified, but the vendor advisory (GHSA-47qp-hqvx-6r3f) documents proof-of-concept methodology; the flaw is not listed in CISA KEV and no EPSS score was supplied.

Technical ContextAI

JLine3 is a Java library for console/line-editing input; the vulnerable code lives specifically in its optional remote-telnet module (org.jline:jline-remote-telnet), which implements a Telnet server supporting RFC 1572 NEW-ENVIRON option negotiation. During negotiation the server parses NE_VAR/NE_USERVAR pairs in TelnetIO.readNEVariables() (TelnetIO.java:1127-1180) and inserts each into the environment map of ConnectionData, which is a plain HashMap constructed with initial capacity 20 and no maximum size (ConnectionData.java:98). This is a textbook CWE-400 (Uncontrolled Resource Consumption): per-variable length limits exist (name ≤50 chars, value ≤1000 chars) but there is no bound on the number of variables, so the parse loop keeps accumulating entries (~2 KB heap each) until the terminating IAC SE arrives. NEW-ENVIRON exchange occurs before authentication, so the allocation is fully attacker-controlled and pre-login.

RemediationAI

Upgrade the org.jline:jline-remote-telnet (and JLine3) dependency to a patched release - Vendor-released patch: 3.30.14, 4.0.16, or 4.2.1, choosing the one matching your current branch (3.30.x, 4.0.x, or 4.2.x). The fix (pull requests https://github.com/jline/jline3/pull/2000 and https://github.com/jline/jline3/pull/2001; commits 0389f0e, 4ee3a73, 934f09e) introduces a NE_VAR_COUNT_MAX cap of 100 variables in readNEVariables(), logging a warning and calling skipToSE()/returning once the limit is exceeded, and also adds upper bounds on reported terminal width/height. If you cannot upgrade immediately, restrict network reachability of the Telnet listener: bind it to localhost or an internal management VLAN, place it behind a firewall rule or ACL that limits source IPs, and require a network-layer gateway/VPN before the port - accepting that this breaks legitimate remote Telnet clients from disallowed networks. As a defense-in-depth measure, run the JVM with a bounded, sensibly-sized heap and enable process supervision/auto-restart so an OutOfMemoryError crash is recovered quickly, and consider disabling the remote-telnet feature entirely if it is not required, which fully removes the attack surface at the cost of remote console access. Details are in the advisory at https://github.com/jline/jline3/security/advisories/GHSA-47qp-hqvx-6r3f.

More in Java

View all

CVE-2012-4681 CRITICAL Emergency POC

9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m

CVE-2015-7450 CRITICAL Emergency POC

9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti

CVE-2013-2465 CRITICAL Act Now POC

9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2010-1871 HIGH Act Now POC

8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to

CVE-2012-1723 CRITICAL Emergency POC

9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2015-4852 CRITICAL Act Now POC

9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL Act Now POC

9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

CVE-2017-3066 CRITICAL Act Now POC

9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla

CVE-2012-0391 CRITICAL Act Now POC

9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all

CVE-2023-44487 HIGH POC

7.5

CVE-2026-45498 HIGH POC

7.5

CVE-2016-8610 HIGH

7.5

CVE-2026-28318 HIGH POC

7.5

7.5

7.5

7.5

7.5

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 16.0	Affected
SUSE Linux Enterprise Server for SAP applications 16.0	Affected
SUSE Linux Enterprise Server 16.0	Affected

CVE-2026-56740 vulnerability details – vuln.today

Back

SUSE Linux Enterprise Server 16.1	Affected
SUSE Linux Enterprise Server for SAP applications 16.0	Affected
SUSE Linux Enterprise Server for SAP applications 16.1	Affected
openSUSE Leap 16.0	Affected

JLine3 CVE-2026-56740

Severity by source

CVSS VectorVendor: GitHub_M

Lifecycle Timeline

Blast Radius

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Java

Same weakness CWE-400 – Uncontrolled Resource Consumption

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code