[GHSA-47qp-hqvx-6r3f] JLine3 Telnet server: Unauthenticated Remote Memory Exhaustion via Unbounded Telnet NEW-ENVIRON Variables

[dolores193]

Updates

• Affected products

Comments
Subject: Affected/patched version range is incomplete — missing 3.x and 4.0.x backport branches

The current advisory only lists a single linear range:
Affected: < 4.2.1
Patched: 4.2.1

However, the fix for this CVE was backported to two additional maintenance
branches and released independently:

• 3.30.x branch → fixed in jline 3.30.14
• 4.0.x branch → fixed in jline 4.0.16

Evidence (official upstream release notes, both explicitly reference this
advisory as a backport):

• https://github.com/jline/jline3/releases/tag/jline-3.30.14
  "Security: Limit telnet NEW-ENVIRON variable count and NAWS geometry
  bounds (backport of GHSA-47qp, GHSA-2r2c)"
• https://github.com/jline/jline3/releases/tag/4.0.16

This is also reflected in OSV.dev's own "extracted_events" for this CVE,
which lists three separate introduced/fixed pairs (0→3.30.14, 4.0.0→4.0.16,
4.1.0→4.2.1):
https://osv.dev/vulnerability/CVE-2026-56740 (or CVE-2026-56741)

Because this GHSA record only encodes the mainline "< 4.2.1" range, scanners
that rely on it (e.g. Trivy, which consults GHSA/OSV exclusively for
pkg:maven/... packages) produce false positives for users who are already on
the patched 3.30.14 / 4.0.16 releases and correctly flag them as still
vulnerable up to 4.2.1.

Could the affected_range / patched_versions be updated to reflect all three
branches, similar to how OSV.dev's extracted_events already models it?

Suggested corrected ranges:

=0 <3.30.14 (3.x branch, fixed in 3.30.14)
=4.0.0 <4.0.16 (4.0.x branch, fixed in 4.0.16)
=4.1.0 <4.2.1 (4.1.x branch, fixed in 4.2.1)

[github]

Hi there @gnodet! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory