https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sun, 30 Aug 2026 13:49:01 +0000 https://vulnerability.circl.lu/sighting/230f579d-7e17-4fee-9249-af1185949cb7/export {"uuid": "230f579d-7e17-4fee-9249-af1185949cb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54338", "type": "seen", "source": "https://gist.github.com/alon710/4b4569a59147cbf248fba613069c312c", "content": "# CVE-2026-54338: CVE-2026-54338: JupyterHub Unauthenticated Denial of Service via Unbounded Username Logging\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54338\n\n## Summary\nJupyterHub is vulnerable to an unauthenticated Denial of Service (DoS) vulnerability. Prior to version 5.5.0, form-based authenticators failed to restrict the size of the username input field on failed logins, allowing remote attackers to exhaust host storage and memory resources.\n\n## TL;DR\nUnauthenticated remote attackers can trigger a Denial of Service on JupyterHub by sending oversized username strings to form-based login endpoints, exhausting system log storage and server memory.\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00282 (Percentile: 20.17%)\n- **Impact**: Denial of Service, Log Injection\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- JupyterHub\n- **jupyterhub**: < 5.5.0 (Fixed in: `5.5.0`)\n\n## Mitigation\n\n- Upgrade to JupyterHub version 5.5.0 or later\n- Transition to third-party non-form authenticators like OAuthenticator\n- Apply reverse proxy rate limiting on the /hub/login route\n- Implement filesystem isolated log rotation and storage quotas\n\n**Remediation Steps:**\n1. Check current JupyterHub installation version using 'jupyterhub --version'\n2. Update JupyterHub deployment packages to version 5.5.0 or higher\n3. Restart the JupyterHub service to load the patched code paths\n4. Configure disk write quotas and log rotation for the logging volume\n\n## References\n\n- [GHSA-p43p-whwx-q52h](https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-p43p-whwx-q52h)\n- [Fix Commit](https://github.com/jupyterhub/jupyterhub/commit/d6dc595f84b7509969686da31d87d6d69e7fce0a)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-54338)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-54338)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54338) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-25T20:33:25.238008Z"} {"uuid": "230f579d-7e17-4fee-9249-af1185949cb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54338", "type": "seen", "source": "https://gist.github.com/alon710/4b4569a59147cbf248fba613069c312c", "content": "# CVE-2026-54338: CVE-2026-54338: JupyterHub Unauthenticated Denial of Service via Unbounded Username Logging\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54338\n\n## Summary\nJupyterHub is vulnerable to an unauthenticated Denial of Service (DoS) vulnerability. Prior to version 5.5.0, form-based authenticators failed to restrict the size of the username input field on failed logins, allowing remote attackers to exhaust host storage and memory resources.\n\n## TL;DR\nUnauthenticated remote attackers can trigger a Denial of Service on JupyterHub by sending oversized username strings to form-based login endpoints, exhausting system log storage and server memory.\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00282 (Percentile: 20.17%)\n- **Impact**: Denial of Service, Log Injection\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- JupyterHub\n- **jupyterhub**: < 5.5.0 (Fixed in: `5.5.0`)\n\n## Mitigation\n\n- Upgrade to JupyterHub version 5.5.0 or later\n- Transition to third-party non-form authenticators like OAuthenticator\n- Apply reverse proxy rate limiting on the /hub/login route\n- Implement filesystem isolated log rotation and storage quotas\n\n**Remediation Steps:**\n1. Check current JupyterHub installation version using 'jupyterhub --version'\n2. Update JupyterHub deployment packages to version 5.5.0 or higher\n3. Restart the JupyterHub service to load the patched code paths\n4. Configure disk write quotas and log rotation for the logging volume\n\n## References\n\n- [GHSA-p43p-whwx-q52h](https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-p43p-whwx-q52h)\n- [Fix Commit](https://github.com/jupyterhub/jupyterhub/commit/d6dc595f84b7509969686da31d87d6d69e7fce0a)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-54338)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-54338)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54338) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-25T20:33:25.238008Z"} https://vulnerability.circl.lu/sighting/230f579d-7e17-4fee-9249-af1185949cb7/export Tue, 25 Aug 2026 20:33:25 +0000