CVE-2026-56741: JLine Telnet Server DoS Vulnerability

CVE-2026-56741 Overview

CVE-2026-56741 is a denial of service vulnerability in JLine, a Java library for handling console input. The flaw affects the JLine3 Telnet server remote-telnet module, which fails to apply an upper bound to terminal dimensions received via the Telnet Negotiate About Window Size (NAWS) option. An unauthenticated remote attacker can send extreme width and height values, such as 65535x65535, and repeatedly alternate them to trigger continuous expensive rendering work. The result is CPU exhaustion and service unavailability. The issue is categorized under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
Unauthenticated remote attackers can exhaust CPU on any exposed JLine3 Telnet server by manipulating NAWS terminal geometry values, causing sustained denial of service.

Affected Products

JLine3 remote-telnet module versions prior to 3.30.14
JLine3 remote-telnet module versions prior to 4.0.16
JLine3 remote-telnet module versions prior to 4.2.1

Discovery Timeline

2026-07-17 - CVE-2026-56741 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-56741

Vulnerability Analysis

The vulnerability resides in TelnetIO.handleNAWS() at TelnetIO.java:856-879 within the JLine3 remote-telnet module. The method reads client-supplied width and height as 16-bit unsigned integers directly from the Telnet NAWS option payload. These values are passed unchecked to setTerminalGeometry(), which drives downstream rendering logic. Because the library performs no sanity checking on the received dimensions, values up to 65535x65535 are accepted as legitimate terminal sizes. The rendering pipeline then allocates buffers and performs layout computations proportional to the reported geometry, consuming significant CPU cycles per event.

Root Cause

The root cause is missing input validation on protocol-supplied dimensions. NAWS is defined in RFC 1073 and typically carries terminal sizes in the range of tens to low hundreds. JLine3 assumed cooperative clients and imposed no upper limit on the accepted values. Combined with the fact that every geometry change triggers a full re-render, the design amplifies each malicious NAWS packet into disproportionate server-side work.

Attack Vector

An attacker connects to an exposed JLine3 Telnet server without authentication and negotiates the NAWS option. The attacker then transmits alternating oversized NAWS subnegotiation frames, such as 65535x65535 followed by 65534x65534. Each frame forces setTerminalGeometry() to invalidate cached layout state and re-run rendering across the entire virtual screen. Sustained transmission from a single connection is sufficient to saturate a CPU core, and multiple parallel connections extend the impact to full host exhaustion.

java

// Patch: introduce believable upper bounds for terminal dimensions
    private static final int SMALLEST_BELIEVABLE_HEIGHT = 6;
    private static final int DEFAULT_WIDTH = 80;
    private static final int DEFAULT_HEIGHT = 25;
+   private static final int LARGEST_BELIEVABLE_WIDTH = 500;
+   private static final int LARGEST_BELIEVABLE_HEIGHT = 500;
    private Connection connection;
    private ConnectionData connectionData;
    private DataOutputStream out;
// Source: https://github.com/jline/jline3/commit/733eb353dca7b0ea0252e724445b6defa29c393e

java

// Additional hardening: cap environment variable count during Telnet negotiation
    protected static final int NE_IN_END = -3;
    protected static final int NE_VAR_NAME_MAXLENGTH = 50;
    protected static final int NE_VAR_VALUE_MAXLENGTH = 1000;
+   protected static final int NE_VAR_COUNT_MAX = 100;
// Source: https://github.com/jline/jline3/commit/3ea9cad8699714dc072fade29d36be0d1e23d708

Detection Methods for CVE-2026-56741

Indicators of Compromise

Sustained high CPU utilization tied to Java processes hosting a JLine3 Telnet listener without a corresponding increase in legitimate session count.
Telnet NAWS subnegotiation frames (IAC SB NAWS) carrying width or height values greater than 500, especially values approaching 65535.
Repeated rapid alternation of terminal geometry values from a single source address within short time windows.

Detection Strategies

Inspect Telnet traffic at the network layer for NAWS option payloads containing oversized 16-bit dimension values and flag any exceeding realistic terminal sizes.
Instrument application logs to record every call to setTerminalGeometry() with source connection metadata, then alert on high call frequency per session.
Correlate CPU spikes on hosts running JLine3-based services with concurrent Telnet session activity to identify abuse patterns.

Monitoring Recommendations

Baseline normal NAWS message rates and geometry ranges for each JLine3 Telnet endpoint and alert on statistical outliers.
Track per-connection resource consumption metrics, including CPU time and rendering iterations, and terminate sessions that exceed thresholds.
Forward Telnet server logs and host telemetry to a centralized analytics platform for cross-source correlation and long-term retention.

How to Mitigate CVE-2026-56741

Immediate Actions Required

Upgrade JLine3 to version 3.30.14, 4.0.16, or 4.2.1 depending on the current release branch in use.
Restrict network exposure of JLine3 Telnet listeners to trusted management networks and require VPN or bastion access.
Enforce rate limiting on Telnet connections and per-connection NAWS message frequency at the network perimeter.

Patch Information

The maintainers released fixes in JLine 3.30.14, 4.0.16, and 4.2.1. The fix introduces LARGEST_BELIEVABLE_WIDTH and LARGEST_BELIEVABLE_HEIGHT constants set to 500 and clamps incoming NAWS values before invoking setTerminalGeometry(). Related hardening also caps the number of accepted environment variables during Telnet negotiation. See the GitHub Security Advisory GHSA-2r2c-cx56-8933, Pull Request #2000, and the 4.2.1 release notes for details.

Workarounds

Disable the JLine3 Telnet server component if it is not required by the application.
Place the Telnet endpoint behind a proxy or firewall that filters or drops NAWS subnegotiations exceeding realistic dimensions.
Terminate long-lived Telnet sessions from unauthenticated sources on a short idle timeout to limit abuse windows.

bash

# Example iptables rule limiting new Telnet (TCP/23) connections per source IP
iptables -A INPUT -p tcp --dport 23 -m conntrack --ctstate NEW \
  -m recent --set --name TELNET
iptables -A INPUT -p tcp --dport 23 -m conntrack --ctstate NEW \
  -m recent --update --seconds 60 --hitcount 10 --name TELNET -j DROP