https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T22:57:52.757984+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-54338 fkie_cve-2026-54338 2026-09-28T22:57:54.861023+00:00

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.

 https://vulnerability.circl.lu/vuln/ghsa-p43p-whwx-q52h GHSA-p43p-whwx-q52h — JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login 2026-09-28T22:57:54.861142+00:00

Affected: PyPI: jupyterhub

### Impact

Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected.

### Patches

Upgrade to 5.5.0.

### Workarounds

Use an Authenticator that doesn't use a login form, such as OAuthenticator.

 https://vulnerability.circl.lu/vuln/pysec-2026-3853 PYSEC-2026-3853 — JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login 2026-09-28T22:57:54.861211+00:00

Affected: PyPI: jupyterhub

### Impact

Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected.

### Patches

Upgrade to 5.5.0.

### Workarounds

Use an Authenticator that doesn't use a login form, such as OAuthenticator.

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-54338 UBUNTU-CVE-2026-54338 2026-09-28T22:57:54.861267+00:00

Affected: Ubuntu:22.04:LTS: jupyterhub, Ubuntu:24.04:LTS: jupyterhub, Ubuntu:26.04:LTS: jupyterhub

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.