CVE-2026-56740 Java — Exploit & Vulnerability Details HIGH

Parameter	Value
CVSS	7.5 (HIGH)
Affected Versions	4.0.0 — 4.2.1
Fixed In	3.30.14
Type	CWE-400 (Uncontrolled Resource Consumption)
Vendor	Java
Public PoC	No

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

Attack Parameters

Attack Vector

Network

Can be exploited remotely

Attack Complexity

Low

Easy to exploit

Privileges Required

None

No privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

None

No data leak

Integrity

None

No data modification

Availability

High

Complete denial of service

CVSS Vector v3.1

Weakness Type (CWE)

CWE-400 Uncontrolled Resource Consumption

Vulnerable Products 3

Configuration	From (including)	Up to (excluding)
Jline Jline cpe:2.3:a:jline:jline::::::::	—	`3.30.14`
Jline Jline cpe:2.3:a:jline:jline::::::::	`4.0.0`	`4.0.16`
Jline Jline cpe:2.3:a:jline:jline::::::::	`4.1.0`	`4.2.1`