JLine provides telnet support for Java applications. The Telnet server component parses the NEW-ENVIRON option without limiting the number of environment variable pairs an attacker can inject. Prior to releases 3.30.14, 4.0.16, and 4.2.1, the TelnetIO.readNEVariables() method stores each pair in a HashMap held by ConnectionData, allowing an unauthenticated remote user to supply thousands of unique variables before the terminating IAC SE byte. This can exhaust the JVM heap and trigger an OutOfMemoryError, causing the process to crash and the service to become unavailable.

Any software that embeds JLine (jline:jline3) and uses its Telnet server module before the patched releases is affected. That includes legacy Java applications, custom console tools, or any remote console service that relies on JLine telnet functionality. The vulnerability is not tied to a specific vendor or product beyond the library itself.

The CVSS base score of 7.5 indicates a high impact, but the EPSS score of <1% and lack of a CISA KEV listing suggest exploitation is unlikely in the wild. An attacker could connect to the exposed Telnet service, send an unlimited number of NEW-ENVIRON variable pairs, and trigger heap exhaustion without authentication. If successful, the target process would terminate or become unresponsive, leading to a denial‑of‑service condition for all users of the service.