https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 22:57:53 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-54338 <p>JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.</p> <p>JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-54338 https://vulnerability.circl.lu/vuln/ghsa-p43p-whwx-q52h <p><strong>Affected:</strong> PyPI: jupyterhub</p> <p>### Impact</p> <p>Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected.</p> <p>### Patches</p> <p>Upgrade to 5.5.0.</p> <p>### Workarounds</p> <p>Use an Authenticator that doesn&#39;t use a login form, such as OAuthenticator.</p> <p><strong>Affected:</strong> PyPI: jupyterhub</p> <p>### Impact</p> <p>Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected.</p> <p>### Patches</p> <p>Upgrade to 5.5.0.</p> <p>### Workarounds</p> <p>Use an Authenticator that doesn&#39;t use a login form, such as OAuthenticator.</p> https://vulnerability.circl.lu/vuln/ghsa-p43p-whwx-q52h https://vulnerability.circl.lu/vuln/pysec-2026-3853 <p><strong>Affected:</strong> PyPI: jupyterhub</p> <p>### Impact</p> <p>Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected.</p> <p>### Patches</p> <p>Upgrade to 5.5.0.</p> <p>### Workarounds</p> <p>Use an Authenticator that doesn&#39;t use a login form, such as OAuthenticator.</p> <p><strong>Affected:</strong> PyPI: jupyterhub</p> <p>### Impact</p> <p>Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected.</p> <p>### Patches</p> <p>Upgrade to 5.5.0.</p> <p>### Workarounds</p> <p>Use an Authenticator that doesn&#39;t use a login form, such as OAuthenticator.</p> https://vulnerability.circl.lu/vuln/pysec-2026-3853 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-54338 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: jupyterhub, Ubuntu:24.04:LTS: jupyterhub, Ubuntu:26.04:LTS: jupyterhub</p> <p>JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: jupyterhub, Ubuntu:24.04:LTS: jupyterhub, Ubuntu:26.04:LTS: jupyterhub</p> <p>JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-54338