Jline3
Monthly
Unauthenticated remote denial of service in the JLine3 remote-telnet server module (versions before 3.30.14, 4.0.16, and 4.2.1) lets an attacker crash the JVM by flooding the Telnet NEW-ENVIRON negotiation with unbounded unique environment-variable pairs. Because TelnetIO.readNEVariables() stores every pair in an uncapped HashMap on ConnectionData before login, roughly 3-4 MB of traffic can exhaust a 512 MB heap and force an OutOfMemoryError. No public exploit code is identified, but the vendor advisory (GHSA-47qp-hqvx-6r3f) documents proof-of-concept methodology; the flaw is not listed in CISA KEV and no EPSS score was supplied.
Denial of service in the JLine3 Telnet server (jline-remote-telnet module) lets an unauthenticated remote attacker exhaust server CPU by abusing the Telnet NAWS window-size option. Because TelnetIO enforces only a lower bound on terminal dimensions, a client can advertise a 65535x65535 terminal and repeatedly alternate values to force continuous, expensive redisplay/rendering cycles. Publicly available exploit code exists (a raw two-packet Telnet PoC is published in the vendor GHSA advisory), and there is no public exploit identified as being actively exploited; the issue is fixed in 3.30.14, 4.0.16, and 4.2.1.
Unauthenticated remote denial of service in the JLine3 remote-telnet server module (versions before 3.30.14, 4.0.16, and 4.2.1) lets an attacker crash the JVM by flooding the Telnet NEW-ENVIRON negotiation with unbounded unique environment-variable pairs. Because TelnetIO.readNEVariables() stores every pair in an uncapped HashMap on ConnectionData before login, roughly 3-4 MB of traffic can exhaust a 512 MB heap and force an OutOfMemoryError. No public exploit code is identified, but the vendor advisory (GHSA-47qp-hqvx-6r3f) documents proof-of-concept methodology; the flaw is not listed in CISA KEV and no EPSS score was supplied.
Denial of service in the JLine3 Telnet server (jline-remote-telnet module) lets an unauthenticated remote attacker exhaust server CPU by abusing the Telnet NAWS window-size option. Because TelnetIO enforces only a lower bound on terminal dimensions, a client can advertise a 65535x65535 terminal and repeatedly alternate values to force continuous, expensive redisplay/rendering cycles. Publicly available exploit code exists (a raw two-packet Telnet PoC is published in the vendor GHSA advisory), and there is no public exploit identified as being actively exploited; the issue is fixed in 3.30.14, 4.0.16, and 4.2.1.