SUSE SLES16: jline3 / jline3-builtins / jline3-console / jline3-console-ui / etc (SUSE-SU-2026:23989-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:23989-1 advisory. This update for jline3 fixes the following issue: Update to upstream version 3.30.17: Security Fixes + Native Stack Buffer Overflow in Publ...

openSUSE 16: jline3 / jline3-builtins / jline3-console / jline3-console-ui / etc (openSUSE-SU-2026:22009-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:22009-1 advisory. This update for jline3 fixes the following issue: Update to upstream version 3.30.17: Security Fixes + Native Stack Buffer Overflow in Public...

OPENSUSE-SU-2026:22009-1 Security update for jline3

This update for jline3 fixes the following issue: Update to upstream version 3.30.17: Security Fixes + Native Stack Buffer Overflow in Public INPUTRECORD.memmove JNI Method Windows GHSA-6r3w-6jpj-x5w6 + Authenticated SSH Shell Channel Resource Leak via Null or Non-Numeric PTY Dimensions...

SUSE-SU-2026:23989-1 Security update for jline3

This update for jline3 fixes the following issue: Update to upstream version 3.30.17: Security Fixes + Native Stack Buffer Overflow in Public INPUTRECORD.memmove JNI Method Windows GHSA-6r3w-6jpj-x5w6 + Authenticated SSH Shell Channel Resource Leak via Null or Non-Numeric PTY Dimensions...

CVE-2026-77420

creationtimestamp| type| source ---|---|--- 2026-09-23 20:35:33+00:00| published-proof-of-concept| https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3...

CVE-2026-77422

creationtimestamp| type| source ---|---|--- 2026-09-23 20:35:23+00:00| published-proof-of-concept| https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw...

CVE-2026-77421

creationtimestamp| type| source ---|---|--- 2026-09-23 20:35:21+00:00| published-proof-of-concept| https://github.com/jline/jline3/security/advisories/GHSA-ph9c-7hw9-vhhw...

JLine: ReDoS in Nano Editor Regex Search Mode

Summary When regex search mode is enabled in the JLine3 nano editor, the user-supplied search term is compiled directly as a Java regular expression with no timeout or backtracking bound. A crafted pattern such as a++b can hang the editor session thread at high CPU, causing a denial of service fo...

GHSA-PH9C-7HW9-VHHW JLine: ReDoS in Nano Editor Regex Search Mode

Summary When regex search mode is enabled in the JLine3 nano editor, the user-supplied search term is compiled directly as a Java regular expression with no timeout or backtracking bound. A crafted pattern such as a++b can hang the editor session thread at high CPU, causing a denial of service fo...

JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping

Summary The JLine3 built-in grep command wraps the user-supplied regular expression with . before compiling it with Java's backtracking regex engine. This amplifies catastrophic backtracking and allows a short pattern such as a++b to hang the command thread on non-matching input. In environments...

GHSA-5Q95-HRPC-M3W3 JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

Summary The JLine3 HISTORYIGNORE variable is converted into a Java regular expression with only partial escaping. As a result, regex metacharacters other than and : are passed through to the regex engine. A crafted value such as a++b can cause catastrophic backtracking each time a command line is...

JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

Summary The JLine3 HISTORYIGNORE variable is converted into a Java regular expression with only partial escaping. As a result, regex metacharacters other than and : are passed through to the regex engine. A crafted value such as a++b can cause catastrophic backtracking each time a command line is...

CVE-2026-56740

A flaw was found in the JLine3 Telnet server remote-telnet module. An unauthenticated remote attacker can exploit this vulnerability by injecting an excessive number of environment variables through the Telnet NEW-ENVIRON option. This action causes the server to store numerous variable pairs,...

CVE-2026-56741

A flaw was found in the JLine3 Telnet server's remote-telnet module. An unauthenticated remote attacker can exploit this vulnerability by repeatedly sending large terminal dimension values through the Telnet Negotiate About Window Size NAWS option. This action triggers continuous,...

openSUSE 16: jline3 / jline3-builtins / jline3-console / jline3-console-ui / etc (openSUSE-SU-2026:21423-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21423-1 advisory. - CVE-2026-56740: unauthenticated remote memory exhaustion via unbounded Telnet NEW-ENVIRON variables bsc1269021. - CVE-2026-56741:...

Security update for jline3 (important)

openSUSE security update: security update for jline3 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21423-1 Rating: important References: bsc1269021 bsc1270083 Cross-References: CVE-2026-56740 CVE-2026-56741 CVSS scores: CVE-2026-56740 SUSE : 7.5...

OPENSUSE-SU-2026:21423-1 Security update for jline3

This update for jline3 fixes the following issues: - CVE-2026-56740: unauthenticated remote memory exhaustion via unbounded Telnet NEW-ENVIRON variables bsc1269021. - CVE-2026-56741: unauthenticated remote DoS via Unbounded Telnet NAWS Terminal Geometry bsc1270083. Changes for jline3: - Update to...

OPENSUSE-SU-2026:11338-1 jline3-3.30.15-3.1 on GA media

These are all security issues fixed in the jline3-3.30.15-3.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-64063

These are all security issues fixed in the jline3-3.30.15-3.1 package on the GA media of openSUSE Tumbleweed...

AZL-92450 CVE-2026-56740 affecting package jline 2.14.6-1

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables in TelnetIO.java:1127-1180...