Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The JLine3 Telnet server (remote-telnet module) does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option. An unauthenticated attacker can flood the server with a large number of unique variable pairs before sending the terminating IAC SE byte, exhausting JVM heap memory and causing an OutOfMemoryError (denial of service). Approximately 3–4 MB of network traffic is sufficient to consume a 512 MB JVM heap. Details TelnetIO.readNEVariables() (TelnetIO.java:1127-1180) processes incoming NEW-ENVIRON variable pairs in a loop and stores each pair in a HashMap held by ConnectionData: The variable accumulator map is a plain HashMap initialized with capacity 20 and no maximum size: Per-variable limits exist (name: max 50 chars, value: max 1000 chars), but there is no cap on the count of variables. Each map entry occupies approximately 2 KB of heap (String headers + Map.Entry + backing char arrays). On a JVM with a 512 MB heap,…
Recommended action: Upgrade to 4.2.1, 4.0.16 or 3.30.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The JLine3 Telnet server (remote-telnet module) does not apply an upper bound to terminal dimensions received via the Telnet NAWS (Negotiate About Window Size) option. An unauthenticated remote attacker can send a NAWS subnegotiation advertising a 65535×65535 terminal and repeatedly alternate values to trigger continuous, expensive rendering work on the server, causing CPU exhaustion and denial of service. Details TelnetIO.handleNAWS() (TelnetIO.java:856-879) reads the client-supplied width and height as 16-bit unsigned integers and passes them to setTerminalGeometry(): Only a lower bound is enforced (minimum 20 columns / 6 rows). Values up to 65535 are accepted and stored. The geometry change event propagates to Telnet.java:153-158 where it calls: terminal.setSize(new Size(65535, 65535)); terminal.raise(Signal.WINCH); The WINCH signal triggers LineReaderImpl.handleSignal() → redisplay(). Inside redisplay(), multiple paths iterate up to size.getColumns() times: - freshLine()…
Recommended action: Upgrade to 4.2.1, 4.0.16 or 3.30.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.