The JLine Telnet server does not limit the terminal geometry values received via the Telnet NAWS option, allowing an unauthenticated attacker to send extremely large width and height values read as 16-bit unsigned integers. These values are then passed to setTerminalGeometry(), which triggers expensive rendering loops that can exhaust CPU resources and produce a denial of service. The flaw revolves around uncontrolled resource consumption (CWE-400).

The vulnerable component is the JLine Java library (jline:jline3). Any installation prior to versions 3.30.14, 4.0.16, or 4.2.1 of the library contains the unbounded NAWS handling and is therefore affected. Updating to at least these patched releases removes the vulnerability.

The CVSS score of 7.5 indicates a high severity. The EPSS score of <1% suggests that, at present, the exploitation probability is very low, and the issue is not listed in CISA’s KEV catalog. However, because the attack vector is remote, unauthenticated, and relies on simple Telnet commands, an attacker can trigger the denial of service without any credentials. The impact is system-wide CPU exhaustion, which may render services unavailable. Given the low exploitation likelihood but significant impact, the vulnerability warrants prompt remediation.