Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
JLine library can cause CPU overload via Telnet
published 3 months ago
Summary
The JLine Java library that supports Telnet connections can be tricked by a remote user into sending extremely large screen size values. This makes the server do a lot of work, using up CPU and potentially stopping the service. Upgrade to the latest JLine version or apply the vendor's patch to stop the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | jline | <= 2.14.6-1 |
Original advisory text
CVE-2026-56741 affecting package jline 2.14.6-1
JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
References
Timeline
Published17 Jul 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-92453 · OSV
Track software like this
Free during beta