Input Validation Flaw in JupyterHub Affects Multi-User Server Operations
CVE-2026-54338
What is CVE-2026-54338?
JupyterHub, a platform facilitating multi-user Jupyter notebook servers, contains a flaw in its form-based login authenticators prior to version 5.5.0. An invalid input can result in an attacker inserting an unbounded username into the failed-login logs. This vulnerability can be exploited by an unauthenticated attacker, allowing them to exhaust logging and storage resources, potentially leading to service disruptions. The issue has been resolved in version 5.5.0, demonstrating the importance of robust input validation in software security.
Affected Version(s)
jupyterhub < 5.5.0JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.