What’s Vulnerable › Vulnerabilities

CVE-2026-54338: JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-07 · updated 2026-09-09
• Weakness: CWE-400

Description

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.

Affected products

• jupyterhub: before 5.5.0JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.

References

• https://github.com/jupyterhub/jupyterhub/commit/d6dc595f84b7509969686da31d87d6d69e7fce0a
• https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-p43p-whwx-q52h

Get alerted when CVE-2026-54338 or the next vulnerability affects your stack