Medium severity5.3NVD Advisory· Published Aug 7, 2026

CVE-2026-54338

Description

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.

Affected products

Jupyter/Jupyterhubllm-fuzzy
Range: <5.5.0

Patches

Vulnerability mechanics

References

github.com/jupyterhub/jupyterhub/commit/d6dc595f84b7509969686da31d87d6d69e7fce0anvd
github.com/jupyterhub/jupyterhub/security/advisories/GHSA-p43p-whwx-q52hnvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000