CVE-2026-56740

A flaw was found in the JLine3 Telnet server remote-telnet module. An unauthenticated remote attacker can exploit this vulnerability by injecting an excessive number of environment variables through the Telnet NEW-ENVIRON option. This action causes the server to store numerous variable pairs,...

CVE-2026-56741

A flaw was found in the JLine3 Telnet server's remote-telnet module. An unauthenticated remote attacker can exploit this vulnerability by repeatedly sending large terminal dimension values through the Telnet Negotiate About Window Size NAWS option. This action triggers continuous,...

openSUSE 16: jline3 / jline3-builtins / jline3-console / jline3-console-ui / etc (openSUSE-SU-2026:21423-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21423-1 advisory. - CVE-2026-56740: unauthenticated remote memory exhaustion via unbounded Telnet NEW-ENVIRON variables bsc1269021. - CVE-2026-56741:...

OPENSUSE-SU-2026:11338-1 jline3-3.30.15-3.1 on GA media

These are all security issues fixed in the jline3-3.30.15-3.1 package on the GA media of openSUSE Tumbleweed...

AZL-92450 CVE-2026-56740 affecting package jline 2.14.6-1

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables in TelnetIO.java:1127-1180...

SUSE-SU-2026:22562-1 Security update for jline3

This update for jline3 fixes the following issues: Changes in jline3: unauthenticated remote memory exhaustion via unbounded Telnet 'NEW-ENVIRON variables bsc1269021...

OPENSUSE-SU-2026:21221-1 Security update for jline3

This update for jline3 fixes the following issues: Changes in jline3: unauthenticated remote memory exhaustion via unbounded Telnet 'NEW-ENVIRON variables bsc1269021...

openSUSE 16: jline3 / jline3-builtins / jline3-console / jline3-console-ui / etc (openSUSE-SU-2026:21221-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21221-1 advisory. Changes in jline3: unauthenticated remote memory exhaustion via unbounded Telnet 'NEW-ENVIRON variables bsc1269021 Tenable has extracted the preceding...

GHSA-47QP-HQVX-6R3F JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables

Summary The JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option. An unauthenticated attacker can flood the server with a large number of unique variable pairs before sending the terminating IAC SE byte,...