Dhoka Pramod created ZOOKEEPER-5075:
---------------------------------------
Summary: Upgrade jline jar to 3.30.14 or higher to fix
CVE-2026-56740
Key: ZOOKEEPER-5075
URL: https://issues.apache.org/jira/browse/ZOOKEEPER-5075
Project: ZooKeeper
Issue Type: Improvement
Affects Versions: 3.9.5
Reporter: Dhoka Pramod
Vulnerability Details:
- CVE-2026-56740 | Severity=high | CVSS=7.5 | Fix Status=fixed in 4.2.1 | Fix
Date=2026-07-21 02:38:43 +0000 UTC
Summary: JLine is a Java library for handling console input. Prior to
3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does
not limit the number of environment variables a client may inject via the
Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in
TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by
ConnectionData, allowing an unauthenticated attacker to flood unique variable
pairs before the terminating IAC SE byte and exhaust JVM heap memory with an
OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
Reference: [https://nvd.nist.gov/vuln/detail/CVE-2026-56740]
- CVE-2026-56741 | Severity=high | CVSS=7.5 | Fix Status=fixed in 4.2.1 | Fix
Date=2026-07-21 02:38:43 +0000 UTC
Reference: [https://nvd.nist.gov/vuln/detail/CVE-2026-56741]
Common Fix Required:
- fixed in 4.2.1
Impacted Packages:
- org.jline_jline-remote-telnet_3.25.1
Impacted Paths:
- /opt/bitnami/zookeeper/lib/jline-3.25.1.jar
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
