AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

JupyterGHSA-p43p-whwx-q52h

JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

Jupyter

CVE-2026-54338 · Published Aug 25, 2026 · updated Sep 29, 2026

Medium5.3
Fix: upgrade to 5.5.0 or later
GitHub advisory

Impact

Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected.

Patches

Upgrade to 5.5.0.

Workarounds

Use an Authenticator that doesn't use a login form, such as OAuthenticator.

Affected versions

PackageAffectedFixed in
jupyterhub
PyPI
< 5.5.05.5.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Severity from
GitHub (reviewed advisory)
Weakness
CWE-400
Also known as
BIT-jupyterhub-2026-54338, CVE-2026-54338, PYSEC-2026-3853

More Jupyter advisories

All Jupyter
High 7.1Sep 17Jupyter Server: 5xx request logging leaks token-bearing Referer header valuesCVE-2026-86049fixed in 2.21.0Medium 6.1Jul 23Jupyter: code executionCVE-2026-6657no fix yetHighJul 22JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)CVE-2026-73417fixed in 4.5.10 +1HighJul 22JupyterLab: Image viewer allows XSS when opening malicious image in new browser tabCVE-2026-73415fixed in 4.5.10 +1MediumJul 22JupyterLab: PyPI extension blocklist package-name canonicalization bypassCVE-2026-73416fixed in 4.5.10 +1MediumJul 22JupyterLab PluginManager lock-rule enforcement bypassCVE-2026-73627fixed in 4.5.10 +1