jline - Debian Package Tracker

general

source: jline (main)
version: 1.0-3
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Torsten Werner [DMD] – tony mancill [DMD] – Varun Hiremath [DMD]
arch: all
std-ver: 4.5.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.0-3
oldstable: 1.0-3
stable: 1.0-3
testing: 1.0-3
unstable: 1.0-3

versioned links

1.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libjline-java (1 bugs: 0, 1, 0, 0)
libjline-java-doc

action needed

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

CVE-2026-56740: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
CVE-2026-56741: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

Created: 2026-07-18 Last update: 2026-07-18 11:01

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-56740: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
CVE-2026-56741: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

Created: 2026-07-18 Last update: 2026-07-18 11:01

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-56740: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
CVE-2026-56741: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

Created: 2026-07-18 Last update: 2026-07-18 11:01

2 security issues in bullseye high

There are 2 open security issues in bullseye.

2 important issues:

CVE-2026-56740: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
CVE-2026-56741: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

Created: 2026-07-18 Last update: 2026-07-18 11:01

2 security issues in bookworm high

There are 2 open security issues in bookworm.

2 important issues:

CVE-2026-56740: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
CVE-2026-56741: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

Created: 2026-07-18 Last update: 2026-07-18 11:01

Multiarch hinter reports 2 issue(s) normal

There are issues with the multiarch metadata for this package.

libjline-java could be marked Multi-Arch: foreign
libjline-java-doc could be marked Multi-Arch: foreign

Created: 2016-09-14 Last update: 2026-07-27 11:34

lintian reports 15 warnings normal

Lintian reports 15 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2021-01-27 Last update: 2025-09-11 00:03

debian/patches: 1 patch to forward upstream low

Among the 1 debian patch available in version 1.0-3 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2023-02-26 15:54

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.5.1).

Created: 2021-08-18 Last update: 2026-03-31 15:01

news

[rss feed]

[2020-12-20] jline 1.0-3 MIGRATED to testing (Debian testing watch)
[2020-12-14] Accepted jline 1.0-3 (source) into unstable (tony mancill)
[2012-06-25] jline 1.0-2 MIGRATED to testing (Debian testing watch)
[2012-06-15] Accepted jline 1.0-2 (source all) (tony mancill)
[2011-08-17] jline 1.0-1 MIGRATED to testing (Debian testing watch)
[2011-08-06] Accepted jline 1.0-1 (source all) (Torsten Werner)
[2009-08-25] jline 0.9.94-5 MIGRATED to testing (Debian testing watch)
[2009-08-14] Accepted jline 0.9.94-5 (source all) (Torsten Werner)
[2009-08-09] Accepted jline 0.9.94-4 (source all) (Torsten Werner)
[2009-08-02] Accepted jline 0.9.94-3 (source all) (Ludovic Claude) (signed by: Torsten Werner)
[2008-03-04] jline 0.9.94-1 MIGRATED to testing (Debian testing watch)
[2008-02-22] Accepted jline 0.9.94-1 (source all) (Varun Hiremath)
[2007-12-06] jline 0.9.93-1 MIGRATED to testing (Debian testing watch)
[2007-11-25] Accepted jline 0.9.93-1 (source all) (Kumar Appaiah) (signed by: Michael Koch)
[2007-11-24] jline 0.9.92-1 MIGRATED to testing (Debian testing watch)
[2007-11-12] Accepted jline 0.9.92-1 (source all) (Kumar Appaiah) (signed by: Michael Koch)
[2007-10-07] jline 0.9.91-1 MIGRATED to testing (Debian testing watch)
[2007-09-26] Accepted jline 0.9.91-1 (source all) (Kumar Appaiah) (signed by: Michael Koch)
[2007-06-27] jline 0.9.5-3 MIGRATED to testing (Debian testing watch)
[2007-06-16] Accepted jline 0.9.5-3 (source all) (Peter Eisentraut)
[2006-05-03] jline 0.9.5-2 MIGRATED to testing (Debian testing watch)
[2006-04-18] Accepted jline 0.9.5-2 (source all) (Peter Eisentraut)
[2006-04-15] jline 0.9.5-1 MIGRATED to testing (Debian testing watch)
[2006-04-03] Accepted jline 0.9.5-1 (source all) (Peter Eisentraut)
[2005-10-05] Accepted jline 0.9.1-2 (source all) (Peter Eisentraut)
[2005-09-17] Accepted jline 0.9.1-1 (source all) (Peter Eisentraut)

bugs [bug history graph]

all: 2
RC: 0
I&N: 1
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (0, 15)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.0-3build1