SB2026090943 - Multiple vulnerabilities in jline3

Description

This security bulletin contains information about 4 vulnerabilities.

1) Stack-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary native code.

The vulnerability exists due to a stack-based buffer overflow in the public INPUT_RECORD.memmove JNI method when calling the method with an oversized size argument. A local user can invoke the method with a caller-controlled source address and oversized size argument to execute arbitrary native code.

The vulnerable native code is compiled exclusively for Windows targets.

2) Improper handling of exceptional conditions (CVE-ID: N/A)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper handling of exceptional conditions in the JLine3 SSH server shell channel startup code when parsing client-supplied PTY dimensions. A remote user can open shell channels with absent or non-numeric COLUMNS or LINES values to cause a denial of service.

The exception prevents the channel cleanup callback from running, leaving the channel open and consuming session channel capacity.

3) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the JLine3 remote-ssh shell channel handler when processing SSH window-change requests with unbounded terminal dimensions. A remote user can send alternating window-change requests with oversized terminal dimensions to cause a denial of service.

Exploitation requires valid SSH credentials and can consume session threads through CPU exhaustion.

4) Missing Release of File Descriptor or Handle after Effective Lifetime (CVE-ID: N/A)

CWE-ID: CWE-775 - Missing Release of File Descriptor or Handle after Effective Lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of a file descriptor after its effective lifetime in the JLine3 Telnet server ConnectionManager.makeConnection() method when handling connections after the maximum connection limit is reached. A remote attacker can repeatedly open TCP connections while the server is at capacity to exhaust the per-process file descriptor limit.

Only applications that embed the remote-telnet module and expose its Telnet server are affected.

Remediation

Install update from vendor's website.

References

• https://github.com/jline/jline3/security/advisories/GHSA-6r3w-6jpj-x5w6
• https://github.com/jline/jline3/security/advisories/GHSA-7h86-pjwh-gpqj
• https://github.com/jline/jline3/security/advisories/GHSA-m935-wqpj-pvp3
• https://github.com/jline/jline3/security/advisories/GHSA-c87g-867h-cqr6