JLine3 Remote Telnet Unauthenticated Remote Memory Exhaustion DoS Vulnerability

Vulnerability Overview Vulnerability Name: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables Description: The JLine3 Telnet server ( module) does not limit the number of environment variables a client can inject via the Telnet NEW-ENVIRON option. An attacker can exhaust JVM heap memory by sending a large number of unique variable pairs, leading to an (Denial of Service). Approximately 3-4 MB of network traffic is sufficient to consume 512 MB of JVM heap. Affected Versions Affected Versions: - >= 4.0.0, < 4.2.1 - < 3.30.14 Fixed Versions: - 4.2.1 - 3.30.14 CVSS Score: 7.5 / 10 Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High Remediation Upgrade to the fixed versions: 4.2.1 or higher 3.30.14 or higher POC Code Details Variable Accumulator Map: It is a standard with an initial capacity of 20 and no maximum size limit. Per-Variable Limits: Limits exist for individual variables (name: max 50 characters, value: max 1000 characters), but there is no upper limit on the total number of variables. Each map entry consumes approximately 2 KB of heap (string header + + backing array bytes). On a JVM with a 512 MB heap, approximately 250,000 unique entries will trigger an . Network Cost: Using sequential single-byte values (e.g., , , ...) and 1-byte values, each variable pair requires approximately 13 protocol bytes. Sending 250,000 pairs requires only about 3.25 MB of network traffic, which can be completed within seconds on a reasonable network connection. No Authentication Required: NEW-ENVIRON negotiation occurs before login. Affected Source Files Lines 1127-1180 Line 98 PoC Connect to the JLine3 Telnet server, and after completing WILL/DO option negotiation, send a NEW-ENVIRON SEND sub-option, followed by a large IS sub-option containing thousands of unique variable pairs, ending with the final IAC SE. Protocol Structure (No Authentication Required) 1. Standard Telnet option negotiation ( , ) 2. Server sends 3. Client responds with - -- Variable Pair 1 - -- Variable Pair 2 - ... Repeat N times ... - -- Sent only after N iterations Each iteration adds an entry to the per-connection environment map. The connection thread blocks on socket reads while accumulating pairs, allowing the attacker to control the timing of the OOM. Reproduction Environment JLine3 built from the current main branch on x86_64 Linux, OpenJDK 25.0.2 The module started with default configuration Confirmed via source code analysis: loop exit conditions and missing count guards verified by inspecting and the constructor Impact Type: Denial of Service (Heap Memory Exhaustion / ) Affected Parties: Any application embedding the JLine3 module and exposing its Telnet server. No credentials are required. A single connection can exhaust the entire JVM heap, causing the host process to crash or triggering JVM out-of-memory handling, affecting all users sharing that JVM instance. Acknowledgments This issue was discovered by Michal Majchrowicz and Marcin Wyczechowski (members of the AFINE Team).

Goal Reached Thanks to every supporter — we hit 100%!

JLine3 Remote Telnet Unauthenticated Remote Memory Exhaustion DoS Vulnerability

More from this source