EUVD-2026-45342
GHSA-2r2c-cx56-8933
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated, network-reachable NAWS input with no user interaction and trivial repetition (AV:N/AC:L/PR:N/UI:N); impact is pure CPU-exhaustion DoS, so A:H with C:N/I:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4Blast Radius
ecosystem impact- 1 maven packages depend on org.jline:jline-remote-telnet (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.2.1.
DescriptionCVE.org
JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
AnalysisAI
Denial of service in the JLine3 Telnet server (jline-remote-telnet module) lets an unauthenticated remote attacker exhaust server CPU by abusing the Telnet NAWS window-size option. Because TelnetIO enforces only a lower bound on terminal dimensions, a client can advertise a 65535x65535 terminal and repeatedly alternate values to force continuous, expensive redisplay/rendering cycles. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application run and expose the JLine3 remote-telnet server module (org.jline:jline-remote-telnet) and that the attacker can reach its Telnet listener; the NAWS option is negotiated before any login, so no authentication is needed (PR:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: network-reachable, low complexity, no privileges, no user interaction, and a pure availability impact with no confidentiality or integrity loss, which matches a CPU-exhaustion DoS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker locates an internet- or LAN-reachable JLine3 Telnet service and, before any login, sends a NAWS subnegotiation declaring a 65535x65535 window, then loops sending alternating values (e.g., 65535 then 65534) so each change raises WINCH and forces a full redisplay. A published PoC (two raw Telnet packets sent in a loop, no authentication) drives the server into continuous ~65k-iteration rendering cycles, saturating CPU and denying service to legitimate users. |
| Remediation | Upgrade JLine to a fixed release on your branch: Vendor-released patch: 3.30.14, 4.0.16, or 4.2.1 (see release notes at https://github.com/jline/jline3/releases/tag/4.0.16 and https://github.com/jline/jline3/releases/tag/4.2.1). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running JLine3 versions predating 3.30.14, 4.0.16, or 4.2.1 and assess network exposure of the jline-remote-telnet module. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today