Security update for jline3

{
  "id": "394dffb676063ece7e8e441c7b1cd1776f4b845529fad99035a5a6779814e2b9",
  "url": "https://osv.dev/vulnerability/SUSE-SU-2026%3A23989-1",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Security update for jline3",
    "summary": "This update for jline3 fixes the following issue: Update to upstream version 3.30.17: * Security Fixes + Native Stack Buffer Overflow in Public INPUT_RECORD.memmove JNI Method (Windows) (GHSA-6r3w-6jpj-x5w6) + Authenticated SSH Shell Channel Resource Leak via Null or Non-Numeric PTY Dimensions (GHSA-7h86-pjwh-gpqj) + Authenticated SSH DoS via Unbounded Window-Change Terminal Geometry (GHSA-m935-wqpj-pvp3) + TCP Socket File Descriptor Leak When Maximum Connections Reached (GHSA-c87g-867h-cqr6) * Bug Fixes + strip control characters from file names in posix builtins + bound !# history expansion to prevent exponential blowup + verify server host keys in the ssh client builtin + address remaining security vulnerabilities reported by AFINE/CERT.PL + backport security fixes from master + backport security fixes to 3.x (path traversal + DSR plain text) + strip control characters from ssh banner and prompts * Dependency updates + bump com.diffplug.spotless:spotless-maven-plugin from 3.8.0 to 3.10.2 + bump slf4j.version from 2.0.18 to 2.0.19 + bump org.apache.maven.plugins:maven-surefire-plugin from 3.5.6 to 3.6.0 + bump org.apache.maven.plugins:maven-compiler-plugin from 3.15.0 to 3.16.0 + bump org.apache.felix:maven-bundle-plugin from 6.0.2 to 6.1.2 + bump actions/setup-java from 5 to 6.0.0 + bump org.graalvm.sdk:graal-sdk from 25.1.3 to 25.3.4.1 + bump com.mycila:license-maven-plugin from 5.0.0 to 5.1.2 + bump org.easymock:easymock from 5.6.0 to 5.7.0 + bump com.google.jimfs:jimfs ",
    "evidence": "osv:SUSE-SU-2026:23989-1",
    "products": [
      {
        "name": {
          "value": "jline3",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.30.17-160000.1.1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "jline3",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.30.17-160000.1.1",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "SUSE-SU-2026:23989-1",
      "aliases": [
        "SUSE-SU-2026:23989-1"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "3.30.17-160000.1.1"
                }
              ]
            }
          ],
          "package": {
            "name": "jline3",
            "purl": "pkg:rpm/suse/jline3&distro=SUSE%20Linux%20Enterprise%20Server%2016.0",
            "ecosystem": "SUSE:Linux Enterprise Server 16.0"
          },
          "database_specific": {
            "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23989-1.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "jline3": "3.30.17-160000.1.1",
                "jline3-jansi": "3.30.17-160000.1.1",
                "jline3-style": "3.30.17-160000.1.1",
                "jline3-curses": "3.30.17-160000.1.1",
                "jline3-native": "3.30.17-160000.1.1",
                "jline3-reader": "3.30.17-160000.1.1",
                "jline3-console": "3.30.17-160000.1.1",
                "jline3-javadoc": "3.30.17-160000.1.1",
                "jline3-builtins": "3.30.17-160000.1.1",
                "jline3-terminal": "3.30.17-160000.1.1",
                "jline3-console-ui": "3.30.17-160000.1.1",
                "jline3-jansi-core": "3.30.17-160000.1.1",
                "jline3-terminal-jna": "3.30.17-160000.1.1",
                "jline3-terminal-jni": "3.30.17-160000.1.1",
                "jline3-remote-telnet": "3.30.17-160000.1.1",
                "jline3-terminal-jansi": "3.30.17-160000.1.1"
              }
            ]
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "3.30.17-160000.1.1"
                }
              ]
            }
          ],
          "package": {
            "name": "jline3",
            "purl": "pkg:rpm/suse/jline3&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0",
            "ecosystem": "SUSE:Linux Enterprise Server for SAP applications 16.0"
          },
          "database_specific": {
            "source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23989-1.json"
          },
          "ecosystem_specific": {
            "binaries": [
              {
                "jline3": "3.30.17-160000.1.1",
                "jline3-jansi": "3.30.17-160000.1.1",
                "jline3-style": "3.30.17-160000.1.1",
                "jline3-curses": "3.30.17-160000.1.1",
                "jline3-native": "3.30.17-160000.1.1",
                "jline3-reader": "3.30.17-160000.1.1",
                "jline3-console": "3.30.17-160000.1.1",
                "jline3-javadoc": "3.30.17-160000.1.1",
                "jline3-builtins": "3.30.17-160000.1.1",
                "jline3-terminal": "3.30.17-160000.1.1",
                "jline3-console-ui": "3.30.17-160000.1.1",
                "jline3-jansi-core": "3.30.17-160000.1.1",
                "jline3-terminal-jna": "3.30.17-160000.1.1",
                "jline3-terminal-jni": "3.30.17-160000.1.1",
                "jline3-remote-telnet": "3.30.17-160000.1.1",
                "jline3-terminal-jansi": "3.30.17-160000.1.1"
              }
            ]
          }
        }
      ],
      "modified": "2026-10-06T17:23:09.114695826Z",
      "provider": "osv",
      "references": [
        "https://www.suse.com/support/update/announcement/2026/suse-su-202623989-1/"
      ]
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 89329,
  "published_at": "2026-10-01T12:14:06+00:00"
}