SUSE-SU-2026:22856-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2026/suse-su-202622856-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:22856-1.json

JSON Data

https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:22856-1

Upstream

CVE (2)

Related

CVE (2)

Published

2026-07-22T16:48:02Z

Modified

2026-07-28T20:42:29Z

Summary

Security update for jline3

Details

This update for jline3 fixes the following issues:

CVE-2026-56740: unauthenticated remote memory exhaustion via unbounded Telnet NEW-ENVIRON variables (bsc#1269021).
CVE-2026-56741: unauthenticated remote DoS via Unbounded Telnet NAWS Terminal Geometry (bsc#1270083).

Changes for jline3:

Update to upstream version 3.30.15

fix: guard regex matching against catastrophic backtracking (ReDoS) (#2018, backport of #2012):
- Adds SafeRegex utility with TimeoutCharSequence to enforce wall-clock deadlines during regex matching
- Fixes 8 locations across terminal, reader, and builtins where user-controlled input could trigger catastrophic backtracking
- Addresses GHSA-r2xf-8xr9-62gw, GHSA-2v9w-34q6-wpqx, GHSA-ph9c-7hw9-vhhw, GHSA-5q95-hrpc-m3w3
fix: backport security hardening (#1986, #1995):
- Create persisted history file with owner-only permissions
- Use exclusive create for extracted native library temp files
fix: warn on insecure permissions when history file created concurrently

References

Affected packages

SUSE:Linux Enterprise Server 16.0 / jline3

Package

Name: jline3
Purl: pkg:rpm/suse/jline3&distro=SUSE%20Linux%20Enterprise%20Server%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.30.15-160000.1.1

Ecosystem specific

{
    "binaries":  [
        {
            "jline3":  "3.30.15-160000.1.1",
            "jline3-builtins":  "3.30.15-160000.1.1",
            "jline3-console":  "3.30.15-160000.1.1",
            "jline3-console-ui":  "3.30.15-160000.1.1",
            "jline3-curses":  "3.30.15-160000.1.1",
            "jline3-jansi":  "3.30.15-160000.1.1",
            "jline3-jansi-core":  "3.30.15-160000.1.1",
            "jline3-javadoc":  "3.30.15-160000.1.1",
            "jline3-native":  "3.30.15-160000.1.1",
            "jline3-reader":  "3.30.15-160000.1.1",
            "jline3-remote-telnet":  "3.30.15-160000.1.1",
            "jline3-style":  "3.30.15-160000.1.1",
            "jline3-terminal":  "3.30.15-160000.1.1",
            "jline3-terminal-jansi":  "3.30.15-160000.1.1",
            "jline3-terminal-jna":  "3.30.15-160000.1.1",
            "jline3-terminal-jni":  "3.30.15-160000.1.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:22856-1.json"

SUSE:Linux Enterprise Server for SAP applications 16.0 / jline3

Package

Name: jline3
Purl: pkg:rpm/suse/jline3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.30.15-160000.1.1

Ecosystem specific

{
    "binaries":  [
        {
            "jline3":  "3.30.15-160000.1.1",
            "jline3-builtins":  "3.30.15-160000.1.1",
            "jline3-console":  "3.30.15-160000.1.1",
            "jline3-console-ui":  "3.30.15-160000.1.1",
            "jline3-curses":  "3.30.15-160000.1.1",
            "jline3-jansi":  "3.30.15-160000.1.1",
            "jline3-jansi-core":  "3.30.15-160000.1.1",
            "jline3-javadoc":  "3.30.15-160000.1.1",
            "jline3-native":  "3.30.15-160000.1.1",
            "jline3-reader":  "3.30.15-160000.1.1",
            "jline3-remote-telnet":  "3.30.15-160000.1.1",
            "jline3-style":  "3.30.15-160000.1.1",
            "jline3-terminal":  "3.30.15-160000.1.1",
            "jline3-terminal-jansi":  "3.30.15-160000.1.1",
            "jline3-terminal-jna":  "3.30.15-160000.1.1",
            "jline3-terminal-jni":  "3.30.15-160000.1.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:22856-1.json"