CVE-2026-54338: JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JupyterHubto a version that resolves this vulnerability.Fixed in 5.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54338?
CVE-2026-54338 has a medium severity rating of 5.3.
How do I fix CVE-2026-54338?
To fix CVE-2026-54338, you should upgrade to JupyterHub version 5.5.0 or later.
What type of vulnerability is CVE-2026-54338?
CVE-2026-54338 is an unauthenticated denial of service vulnerability related to unbounded username logging.
Who is affected by CVE-2026-54338?
Users of JupyterHub prior to version 5.5.0 are affected by CVE-2026-54338.
What impact does CVE-2026-54338 have?
CVE-2026-54338 can lead to logging and storage consumption by allowing attacker-controlled usernames in failed login logs.