CyberRota Analysis
AI-GeneratedThe JLine library for Java is vulnerable to a denial-of-service attack due to an unbounded number of environment variables that can be injected via the Telnet NEW-ENVIRON option, potentially leading to JVM heap exhaustion. This flaw allows unauthenticated attackers to exploit the Telnet server module, resulting in an OutOfMemoryError. Organizations using affected versions of JLine should prioritize upgrading to versions 3.30.14, 4.0.16, or 4.2.1 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.