openSUSE-SU-2026:21423-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21423-1.json

JSON Data

https://api.test.osv.dev/v1/vulns/openSUSE-SU-2026:21423-1

Upstream

CVE (2)

Related

CVE (2)

Published

2026-07-22T16:48:17Z

Modified

2026-07-24T18:24:31Z

Summary

Security update for jline3

Details

This update for jline3 fixes the following issues:

CVE-2026-56740: unauthenticated remote memory exhaustion via unbounded Telnet NEW-ENVIRON variables (bsc#1269021).
CVE-2026-56741: unauthenticated remote DoS via Unbounded Telnet NAWS Terminal Geometry (bsc#1270083).

Changes for jline3:

Update to upstream version 3.30.15

fix: guard regex matching against catastrophic backtracking (ReDoS) (#2018, backport of #2012):
- Adds SafeRegex utility with TimeoutCharSequence to enforce wall-clock deadlines during regex matching
- Fixes 8 locations across terminal, reader, and builtins where user-controlled input could trigger catastrophic backtracking
- Addresses GHSA-r2xf-8xr9-62gw, GHSA-2v9w-34q6-wpqx, GHSA-ph9c-7hw9-vhhw, GHSA-5q95-hrpc-m3w3
fix: backport security hardening (#1986, #1995):
- Create persisted history file with owner-only permissions
- Use exclusive create for extracted native library temp files
fix: warn on insecure permissions when history file created concurrently

References

Affected packages

openSUSE:Leap 16.0 / jline3

Package

Name: jline3
Purl: pkg:rpm/opensuse/jline3&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.30.15-160000.1.1

Ecosystem specific

{
    "binaries": [
        {
            "jline3": "3.30.15-160000.1.1",
            "jline3-builtins": "3.30.15-160000.1.1",
            "jline3-console": "3.30.15-160000.1.1",
            "jline3-console-ui": "3.30.15-160000.1.1",
            "jline3-curses": "3.30.15-160000.1.1",
            "jline3-jansi": "3.30.15-160000.1.1",
            "jline3-jansi-core": "3.30.15-160000.1.1",
            "jline3-javadoc": "3.30.15-160000.1.1",
            "jline3-native": "3.30.15-160000.1.1",
            "jline3-reader": "3.30.15-160000.1.1",
            "jline3-remote-telnet": "3.30.15-160000.1.1",
            "jline3-style": "3.30.15-160000.1.1",
            "jline3-terminal": "3.30.15-160000.1.1",
            "jline3-terminal-jansi": "3.30.15-160000.1.1",
            "jline3-terminal-jna": "3.30.15-160000.1.1",
            "jline3-terminal-jni": "3.30.15-160000.1.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21423-1.json"