Skip to content

[FP]: CVE-2026-56740 / CVE-2026-56741 / CVE-2023-50572 (JLine 3.x org.jline modules) wrongly matched against legacy jline:jline 1.0 / 2.14.6 #8882

New issue
New issue
Closed as not planned
Closed as not planned
[FP]: CVE-2026-56740 / CVE-2026-56741 / CVE-2023-50572 (JLine 3.x org.jline modules) wrongly matched against legacy jline:jline 1.0 / 2.14.6#8882
Labels
FP Reportmavenchanges to the maven plugin

Description

@prabutdr
prabutdr
opened on Nov 3, 2026

Package URl

pkg:maven/jline/jline@2.14.6

CPE

cpe:2.3:a:jline:jline:2.14.6:::::::*

CVE

No response

ODC Integration

{"label" => "Maven Plugin"}

ODC Version

13.0.0

Description

These vulnerabilities affect the modern JLine 3.x line (groupId org.jline): CVE-2026-56740 / CVE-2026-56741 reside in the jline-remote-telnet module (org.jline:jline-remote-telnet, class TelnetIO), and CVE-2023-50572 resides in the jline-groovy module (org.jline:jline-groovy, GroovyEngine.execute, fixed in the 3.25.x line). The components in scope are the legacy jline artifacts jline-2.14.6 and jline-1.0 (pkg:maven/jline/jline@2.14.6, pkg:maven/jline/jline@1.0), which are a different codebase under the old jline groupId. These legacy 1.x/2.x artifacts contain no jline-remote-telnet module, no Telnet server implementation, and no jline-groovy module / GroovyEngine, so the vulnerable code is not present in the matched artifacts. The dependency-check tool incorrectly matched the legacy jline:jline artifacts against JLine 3.x (org.jline) CVEs based on the shared "jline" keyword, across a different groupId and a different version branch.

From Dependency Check tool team, we need confirmation on these false positives. Could you please validate and confirm?

Activity

  1. prabutdr
    added
    FP Report
    on Nov 3, 2026

  2. github-actions commented on Nov 3, 2026

    @github-actions
    github-actionsBot
    on Nov 3, 2026 – with GitHub Actions
    Contributor

    Maven Coordinates

    <dependency>
  <groupId>jline</groupId>
  <artifactId>jline</artifactId>
  <version>2.14.6</version>
</dependency>

    Suppression rule:

    <suppress base="true">
    <notes><![CDATA[
    FP per issue #8882
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/jline/jline@.*$</packageUrl>
    <cpe regex="true">cpe:/a:jline:jline(:.*)?$</cpe>
</suppress>

    Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/41655400146

  3. github-actions
    added
    mavenchanges to the maven plugin
    on Nov 3, 2026
  4. chadlwilson
    closed this as not plannedon Nov 3, 2026

  5. chadlwilson commented on Nov 3, 2026

    @chadlwilson
    chadlwilson
    on Nov 3, 2026
    Collaborator

    ODC project is not your personal security advisor. If you trust it so much, use your LLM to manage your own suppressions and analysis rather than slopping it onto an open source project to do the work for you for free. The above analysis of why the matching happened is complete and utter rubbish.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    FP Reportmavenchanges to the maven plugin

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions