CVE-2026-54338: JupyterHub Unauthenticated Denial of Service via Unbounded Username Logging
Vulnerability ID: CVE-2026-54338
CVSS Score: 5.3
Published: 2026-08-25
JupyterHub is vulnerable to an unauthenticated Denial of Service (DoS) vulnerability. Prior to version 5.5.0, form-based authenticators failed to restrict the size of the username input field on failed logins, allowing remote attackers to exhaust host storage and memory resources.
TL;DR
Unauthenticated remote attackers can trigger a Denial of Service on JupyterHub by sending oversized username strings to form-based login endpoints, exhausting system log storage and server memory.
Technical Details
- CWE ID: CWE-400
- Attack Vector: Network
- CVSS v3.1 Score: 5.3 (Medium)
- EPSS Score: 0.00282 (Percentile: 20.17%)
- Impact: Denial of Service, Log Injection
- Exploit Status: None
- CISA KEV Status: Not Listed
Affected Systems
- JupyterHub
-
jupyterhub: < 5.5.0 (Fixed in:
5.5.0)
Mitigation Strategies
- Upgrade to JupyterHub version 5.5.0 or later
- Transition to third-party non-form authenticators like OAuthenticator
- Apply reverse proxy rate limiting on the /hub/login route
- Implement filesystem isolated log rotation and storage quotas
Remediation Steps:
- Check current JupyterHub installation version using 'jupyterhub --version'
- Update JupyterHub deployment packages to version 5.5.0 or higher
- Restart the JupyterHub service to load the patched code paths
- Configure disk write quotas and log rotation for the logging volume
References
Read the full report for CVE-2026-54338 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)