CVE-2026-56741

NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-56741
CWE	https://cwe.mitre.org/data/definitions/400.html

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

Weakness

The product does not properly control the allocation and maintenance of a limited resource.

Potential Mitigations

Mitigation of resource exhaustion attacks requires that the target system either:
The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
The second solution is simply difficult to effectively institute – and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.

Uncontrolled Resource Consumption

Weakness

Potential Mitigations

References

CVE-2026-56741

Uncontrolled Resource Consumption

Weakness

Potential Mitigations

Related Attack Patterns

References