CVE-2026-54338
JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.
- Record
CVE-2026-54338- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2026-54678
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.
- Record
EUVD-2026-54678- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p43p-whwx-q52h
JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
Impact
Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected.
Patches
Upgrade to 5.5.0.
Workarounds
Use an Authenticator that doesn't use a login form, such as OAuthenticator.
- Record
GHSA-p43p-whwx-q52h- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.
- Record
CVE-2026-54338- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.
- Record
CVE-2026-54338- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-54338
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.
- Record
DEBIAN-CVE-2026-54338- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-p43p-whwx-q52h
JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
Impact
Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected.
Patches
Upgrade to 5.5.0.
Workarounds
Use an Authenticator that doesn't use a login form, such as OAuthenticator.
- Record
GHSA-p43p-whwx-q52h- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVPYSEC-2026-3853
JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
Impact
Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected.
Patches
Upgrade to 5.5.0.
Workarounds
Use an Authenticator that doesn't use a login form, such as OAuthenticator.
- Record
PYSEC-2026-3853- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-54338
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.
- Record
UBUNTU-CVE-2026-54338- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVBIT-jupyterhub-2026-54338 No score
JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.
- Record
BIT-jupyterhub-2026-54338- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jupyterhubPyPI |
before 5.5.0 | 5.5.0 |
jupyterhubBitnami |
before 5.5.0 | 5.5.0 |
jupyterhubDebian:12 |
All versions, plus listed versions 3.0.0+ds1-15.0.0+ds1-15.0.0+ds1-25.0.0+ds1-35.0.0+ds1-4 Show 5 moreShow less5.2.1+ds1-15.2.1+ds1-25.2.1+ds1-35.2.1+ds1-45.2.1+ds1-5 |
None known |
jupyterhubDebian:13 |
All versions, plus listed versions 5.2.1+ds1-45.2.1+ds1-5 |
None known |
jupyterhubDebian:14 |
All versions, plus listed versions 5.2.1+ds1-45.2.1+ds1-5 |
None known |
jupyterhubPyPI |
before 5.5.0, plus listed versions 0.1.00.2.00.3.00.4.00.4.1 Show 45 moreShow less0.5.00.6.00.6.10.7.00.7.0b10.7.10.7.20.8.00.8.0b10.8.0b20.8.0b30.8.0b40.8.0b50.8.0rc10.8.0rc20.8.10.9.00.9.0b10.9.0b20.9.0b30.9.0rc10.9.10.9.20.9.30.9.40.9.50.9.61.0.01.0.0b11.0.0b21.1.01.1.0b11.2.01.2.0b11.2.11.2.21.3.01.4.01.4.11.4.21.5.01.5.12.0.02.0.0b12.0.0b2 |
5.5.0 |
jupyterhubUbuntu:22.04:LTS |
All versions, plus listed versions 2.0.0+ds1-12.0.0+ds1-2 |
None known |
jupyterhubUbuntu:24.04:LTS |
All versions, plus listed versions 3.0.0+ds1-1 |
None known |
jupyterhubUbuntu:26.10 |
All versions, plus listed versions 5.2.1+ds1-45.2.1+ds1-5 |
None known |
jupyterhubUbuntu:26.04:LTS |
All versions, plus listed versions 5.2.1+ds1-4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-54338 is a medium vulnerability (CVSS 5.3) in Jupyterhub, published August 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in jupyterhub 5.5.0.
References
github.com/jupyterhub/jupyterhub/security/advisories/GHSA-p43p-whwx-q52h
nvd.nist.gov/vuln/detail/CVE-2026-54338
security-tracker.debian.org/tracker/CVE-2026-54338
Left out here: 46 versions. The JSON record has them.