Most recent entries from all

Withdrawn: CLEANSTART-2026-AM39668 — yawkat LZ4 Java provides LZ4 compression for Java

Withdrawn by the publisher.

Affected: CleanStart: apache-nifi

Multiple security vulnerabilities affect the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details.

EUVD-2026-338879

fkie_cve-2026-56740

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

GHSA-47qp-hqvx-6r3f — JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables

Affected: Maven: org.jline:jline-remote-telnet

### Summary

The JLine3 Telnet server (`remote-telnet` module) does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option. An unauthenticated attacker can flood the server with a large number of unique variable pairs before sending the terminating IAC SE byte, exhausting JVM heap memory and causing an OutOfMemoryError (denial of service). Approximately 3–4 MB of network traffic is sufficient to consume a 512 MB JVM heap.

### Details

`TelnetIO.readNEVariables()` (TelnetIO.java:1127-1180) processes incoming NEW-ENVIRON variable pairs in a loop and stores each pair in a `HashMap` held by `ConnectionData`:

```java // TelnetIO.java:1139-1178 boolean cont = true; if (i == NE_VAR || i == NE_USERVAR) { do { switch (readNEVariableName(sbuf)) { case NE_VAR_OK: TelnetIO.this.connectionData.getEnvironment().put(str, sbuf.toString()); // ← no per-connection count limit break; case NE_VAR_UNDEFINED: break; // cont remains true, loop continues } } while (cont); // cont is never set to false; only exits via return } ```

The variable accumulator map is a plain `HashMap` initialized with capacity 20 and **no maximum size**:

```java // ConnectionData.java:98 environment = new HashMap<String, String>(20); ```

Per-variable limits exist (name: max 50 chars, value: max 1000 chars), but there is no cap on the *count* of variables. Each…

openSUSE-SU-2026:11338-1 — jline3-3.30.15-3.1 on GA media

jline3-3.30.15-3.1 on GA media

SUSE-SU-2026:22856-1 — Security update for jline3

Security update for jline3

UBUNTU-CVE-2026-56740

Affected: Ubuntu:14.04:LTS: jline, Ubuntu:14.04:LTS: jline2, Ubuntu:16.04:LTS: jline, Ubuntu:16.04:LTS: jline2, Ubuntu:18.04:LTS: jline, Ubuntu:18.04:LTS: jline2, Ubuntu:20.04:LTS: jline, Ubuntu:20.04:LTS: jline2, Ubuntu:22.04:LTS: jline, Ubuntu:22.04:LTS: jline2 and 7 more