JupyterGHSA-p43p-whwx-q52h
JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
Medium5.3CVE-2026-54338 · Published Aug 25, 2026 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| jupyterhub PyPI | < 5.5.0 | 5.5.0 |
Details and references
### Impact Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected. ### Patches Upgrade to 5.5.0. ### Workarounds Use an Authenticator that doesn't use a login form, such as OAuthenticator.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-400
- Also known as
- CVE-2026-54338, PYSEC-2026-3853
More Jupyter advisories
All Jupyter| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 17 | Jupyter Server: 5xx request logging leaks token-bearing Referer header values CVE-2026-86049High7.1fixed in 2.21.0 | High7.1 | 2.21.0 |
| Jul 23 | jupyter-server is vulnerable to CORS origin validation bypass when the `allow_origin_pat` configuration is used CVE-2026-6657Medium6.1no fix yet | Medium6.1 | No fix yet |
| Jul 22 | JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`) CVE-2026-73417Highfixed in 4.5.10, 4.6.2 | High | 4.5.10, 4.6.2 |
| Jul 22 | JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab CVE-2026-73415Highfixed in 4.5.10, 4.6.2 | High | 4.5.10, 4.6.2 |
| Jul 22 | JupyterLab: PyPI extension blocklist package-name canonicalization bypass CVE-2026-73416Mediumfixed in 4.5.10, 4.6.2 | Medium | 4.5.10, 4.6.2 |
| Jul 22 | JupyterLab PluginManager lock-rule enforcement bypass GHSA-h5v5-8746-g7mmMediumfixed in 4.5.10, 4.6.2 | Medium | 4.5.10, 4.6.2 |