CVE-2026-56740Disclosure(jline / jline)

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch jline jline systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

jline CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Other references

Weakness type (CWE)

CWE-400

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

jline

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-07-17); latest day: 2
4 total mentions across 2 days

Affected systems

Vendors

jline

Products

jline

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

Disclosure

250.0%

General

125.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-17	2	General1Patch1
2026-07-18	2	Disclosure2

Full discourse4 posts

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters91d
Disclosure
#CVE-2026-56740 - DoS in #JLine #Telnet server. Unauthenticated attackers can flood env variables to exhaust #JVM heap memory. #CVSS 7.5. No patch yet - disable telnet module if possible. #CVEAlert #infosec #Java #developer #git #github #gitlab https://www.valtersit.com/cve/CVE-2026-56740
Post summary
The post announces a denial‑of‑service flaw (CVE‑2026‑56740) in the JLine Telnet server, highlights its CVSS score, notes no patch is available, and suggests disabling the telnet module as a workaround.
0000076
984 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
Disclosure
CVE-2026-56740 Denial of Service via Unbounded Environment Variable Injection in JLine3 Telnet Server https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-56740
Post summary
The text announces a new denial‑of‑service vulnerability (CVE-2026-56740) in the JLine3 Telnet Server, specifying its nature but providing no PoC, exploit, patch, or claim of active exploitation.
0000097
4.1K followersView on X
Infoflowcloud@infoflowcloud91d
General
🚨*CVE* CVE-2026-56740 JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of en… https://www.cve.org/CVERecord?id=CVE-2026-56740 ----- Traducción: CVE-2026-56740 JLi… http://infoflow.cloud`
Post summary
The post announces CVE-2026-56740, noting a specific limitation in JLine3’s Telnet server module, but it does not provide PoC, exploit, patch, or active exploitation details.
0000037
92 followersView on X
CVE@CVEnew91d
Patch
CVE-2026-56740 JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of en… https://www.cve.org/CVERecord?id=CVE-2026-56740
Post summary
CVE‑2026‑56740 is a vulnerability in JLine’s Telnet remote‑telnet module, affecting versions prior to 3.30.14, 4.0.16, and 4.2.1, with the fix shipped in those newer releases.
00000740
57.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	jline	jline	-	-	-

Explore more

Back to dashboard jline CVEs jline vulnerabilities

What researchers are saying

CVE-2026-56740

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersDisclosure

The post announces a denial‑of‑service flaw (CVE‑2026‑56740) in the JLine Telnet server, highlights its CVSS score, notes no patch is available, and suggests disabling the telnet module as a workaround.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces a new denial‑of‑service vulnerability (CVE-2026-56740) in the JLine3 Telnet Server, specifying its nature but providing no PoC, exploit, patch, or claim of active exploitation.

Infoflowcloud@infoflowcloudGeneral

The post announces CVE-2026-56740, noting a specific limitation in JLine3’s Telnet server module, but it does not provide PoC, exploit, patch, or active exploitation details.

CVE@CVEnewPatch

CVE‑2026‑56740 is a vulnerability in JLine’s Telnet remote‑telnet module, affecting versions prior to 3.30.14, 4.0.16, and 4.2.1, with the fix shipped in those newer releases.