Jline
Monthly
Unauthenticated remote denial of service in the JLine3 remote-telnet server module (versions before 3.30.14, 4.0.16, and 4.2.1) lets an attacker crash the JVM by flooding the Telnet NEW-ENVIRON negotiation with unbounded unique environment-variable pairs. Because TelnetIO.readNEVariables() stores every pair in an uncapped HashMap on ConnectionData before login, roughly 3-4 MB of traffic can exhaust a 512 MB heap and force an OutOfMemoryError. No public exploit code is identified, but the vendor advisory (GHSA-47qp-hqvx-6r3f) documents proof-of-concept methodology; the flaw is not listed in CISA KEV and no EPSS score was supplied.
Denial of service in the JLine3 Telnet server (jline-remote-telnet module) lets an unauthenticated remote attacker exhaust server CPU by abusing the Telnet NAWS window-size option. Because TelnetIO enforces only a lower bound on terminal dimensions, a client can advertise a 65535x65535 terminal and repeatedly alternate values to force continuous, expensive redisplay/rendering cycles. Publicly available exploit code exists (a raw two-packet Telnet PoC is published in the vendor GHSA advisory), and there is no public exploit identified as being actively exploited; the issue is fixed in 3.30.14, 4.0.16, and 4.2.1.
An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM (OutofMemory) error. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated remote denial of service in the JLine3 remote-telnet server module (versions before 3.30.14, 4.0.16, and 4.2.1) lets an attacker crash the JVM by flooding the Telnet NEW-ENVIRON negotiation with unbounded unique environment-variable pairs. Because TelnetIO.readNEVariables() stores every pair in an uncapped HashMap on ConnectionData before login, roughly 3-4 MB of traffic can exhaust a 512 MB heap and force an OutOfMemoryError. No public exploit code is identified, but the vendor advisory (GHSA-47qp-hqvx-6r3f) documents proof-of-concept methodology; the flaw is not listed in CISA KEV and no EPSS score was supplied.
Denial of service in the JLine3 Telnet server (jline-remote-telnet module) lets an unauthenticated remote attacker exhaust server CPU by abusing the Telnet NAWS window-size option. Because TelnetIO enforces only a lower bound on terminal dimensions, a client can advertise a 65535x65535 terminal and repeatedly alternate values to force continuous, expensive redisplay/rendering cycles. Publicly available exploit code exists (a raw two-packet Telnet PoC is published in the vendor GHSA advisory), and there is no public exploit identified as being actively exploited; the issue is fixed in 3.30.14, 4.0.16, and 4.2.1.
An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM (OutofMemory) error. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.