jline3 - Debian Package Tracker

general

source: jline3 (main)
version: 3.3.1-5
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Saif Abdul Cassim [DMD] – Samyak Jain [DMD]
arch: all
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.3.1-2
oldstable: 3.3.1-3
stable: 3.3.1-4
testing: 3.3.1-5
unstable: 3.3.1-5
NEW/unstable: 3.29.0+ds-1

versioned links

3.3.1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.3.1-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.3.1-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.3.1-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libjline3-java

action needed

A new upstream version is available: 3.30.17 high

A new upstream version 3.30.17 is available, you should consider packaging it.

Created: 2026-03-26 Last update: 2026-10-30 11:01

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-56740: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
CVE-2026-56741: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

Created: 2026-07-18 Last update: 2026-09-29 14:31

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-56740: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
CVE-2026-56741: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

Created: 2026-07-18 Last update: 2026-09-29 14:31

2 security issues in bookworm high

There are 2 open security issues in bookworm.

2 important issues:

CVE-2026-56740: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
CVE-2026-56741: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

Created: 2026-07-18 Last update: 2026-09-29 14:31

2 security issues in bullseye high

There are 2 open security issues in bullseye.

2 important issues:

CVE-2026-56740: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
CVE-2026-56741: JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

Created: 2026-07-18 Last update: 2026-08-09 22:31

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 3.29.0+ds-1, distribution unstable) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit f6d1e9bb281f15a12f0328ed89348777a2e6b897
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Wed Oct 28 10:37:46 2026 +0100

    d/copyright: the unescape() gist is MIT, per its author

commit 035850b459e40123408479d38fcfe9b5969ea9c8
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Wed Oct 28 10:11:33 2026 +0100

    d/copyright: code adapted from Apache Felix and Apache Karaf
    
    remote-ssh ShellCommand/ShellFactoryImpl, remote-telnet Telnet and style
    InterpolationHelper (all built), demo Reflective/FunctionConverter and the
    terminal test ScreenTerminal carry only the JLine header but are adapted
    from Apache Felix gogo/utils and Apache Karaf.

commit 40f27c47e56dc64c1f899d4ddfffee503e51468c
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Wed Oct 28 09:54:09 2026 +0100

    d/copyright: files copied from third parties without their header
    
    - jansi-core, from Jansi 2.4 (Apache-2.0, Progress Software for the 1.x
      parts), and the native and terminal* sources adapted from Jansi;
    - terminal's InputStreamReader from Apache Harmony and WCWidth from
      Markus Kuhn's wcwidth.c;
    - the *.caps printed by infocmp from the ncurses terminfo database;
    - the remote-telnet TelnetD files under their own BSD licence text;
    - the nano and less builtin help texts, copied from GNU nano 2.2 and
      less 481, and the nano-derived *.nanorc and the nanorc themes;
    - console SystemRegistryImpl.unescape() (Udo Klimaschewski's gist),
      groovy PackageHelper (Stack Overflow, CC BY-SA 4.0), the builtins
      test config1/config2 (Readline manual) and console-ui/doc (ConsoleUI).

commit d1b112c095d75ebcbec746f2d8d833ed3cc20969
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Wed Oct 28 09:10:35 2026 +0100

    d/copyright: console-ui/LICENSE.txt only; add lrc.config
    
    The console-ui sources carry the JLine BSD-3-clause header, so they
    fall under Files: *. Only console-ui/LICENSE.txt is Apache-2.0.
    Add the holder spelling "the original author or authors", the ASF as
    holder of the dual-header files and the Ajaxterm provenance of
    ScreenTerminal.java. debian/lrc.config maps the dual-header files,
    where licensecheck sees only the Apache-2.0 notice.

commit dfa4d1a551b9d8dc15ea9248f865f747dd0f743c
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Wed Oct 28 08:49:28 2026 +0100

    d/copyright: declare the Apache-2.0-only files and console-ui
    
    Add stanzas for the native C sources, the terminal provider service
    files and the ASF-headed build files, which carry only an Apache-2.0
    header. console-ui comes from Andreas Wegmann's Apache-2.0 ConsoleUI,
    so list him and both licenses. Add the upstream holder to Files: *.

commit 1d258f1845a641614309d4b47db871c3d2490778
Author: Simon Quigley <tsimonq2@debian.org>
Date:   Tue Oct 27 19:00:26 2026 -0500

    Team upload.

commit dd8229f121f0736e8252e7c61f21d5215cdc4a8f
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Fri Oct 2 19:27:20 2026 +0200

    Build the JNI library with the Debian build flags

commit 2795b0a8d5b8f9e1c78b76525798606ff6820aff
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Fri Oct 2 18:27:44 2026 +0200

    d/maven.rules: use the debian version for jna, jansi and sshd

commit 0f0474ecb0eba163f37d92e02c43b1fa8f28c61b
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Wed Jun 10 20:15:47 2026 +0200

    Fix copyright license mapping (builtins/reader BSD vs Apache, add ASF Felix Posix.java, drop absent holder); drop redundant Priority

commit 90bccae7ef37b5139d196b5cfc2dc45cd7b78de2
Merge: c019259 456d897
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Wed Jun 10 12:49:39 2026 +0200

    Update upstream source from tag 'upstream/3.29.0+ds'
    
    Update to upstream version '3.29.0+ds'
    with Debian dir 702ca5500aed94b843576d7ebd0a3747a76962de

commit 456d8970422c9f7954241eb053a0709eb57ed8c7
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Wed Jun 10 12:49:37 2026 +0200

    New upstream version 3.29.0+ds

commit c019259d72420562f57964a882ac9c56bafa66b4
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Wed Jun 10 12:49:24 2026 +0200

    Packaging for 3.29.0+ds-1: full build incl. native-from-C; d/watch v5 +ds; build-deps; maven.rules; drop obsolete patches; add remove-werror; Salsa CI

https://salsa.debian.org/api/v4/projects/java-team%2Fjline3 API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-10-28 Last update: 2026-10-28 15:20

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2026-56740: (needs triaging) JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables() in TelnetIO.java:1127-1180 stores each variable pair in a HashMap held by ConnectionData, allowing an unauthenticated attacker to flood unique variable pairs before the terminating IAC SE byte and exhaust JVM heap memory with an OutOfMemoryError. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.
CVE-2026-56741: (needs triaging) JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not apply an upper bound to terminal dimensions received via the Telnet NAWS option, and TelnetIO.handleNAWS() in TelnetIO.java:856-879 reads client-supplied width and height as 16-bit unsigned integers and passes values such as 65535x65535 to setTerminalGeometry(), allowing an unauthenticated remote attacker to repeatedly alternate values and trigger continuous expensive rendering work that causes CPU exhaustion and denial of service. This issue is fixed in versions 3.30.14, 4.0.16, and 4.2.1.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-07-18 Last update: 2026-09-29 14:31

debian/patches: 1 patch to forward upstream low

Among the 4 debian patches available in version 3.3.1-5 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2026-03-26 Last update: 2026-03-26 15:02

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.0).

Created: 2025-02-21 Last update: 2026-03-31 15:01

news

[rss feed]

[2026-03-31] jline3 3.3.1-5 MIGRATED to testing (Debian testing watch)
[2026-03-26] Accepted jline3 3.3.1-5 (source) into unstable (tony mancill)
[2024-07-16] jline3 3.3.1-4 MIGRATED to testing (Debian testing watch)
[2024-07-11] Accepted jline3 3.3.1-4 (source) into unstable (Emmanuel Bourg)
[2022-05-23] jline3 3.3.1-3 MIGRATED to testing (Debian testing watch)
[2022-05-18] Accepted jline3 3.3.1-3 (source) into unstable (Emmanuel Bourg)
[2021-01-23] jline3 3.3.1-2 MIGRATED to testing (Debian testing watch)
[2021-01-18] Accepted jline3 3.3.1-2 (source) into unstable (Emmanuel Bourg)
[2020-07-13] Accepted jline3 3.3.1-1 (source all) into unstable, unstable (Debian FTP Masters) (signed by: Emmanuel Bourg)

bugs [bug history graph]

all: 2
RC: 0
I&N: 2
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.3.1-5
1 bug