CVE-2026-54338 json
JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
published 2026-08-07 3 mo ago modified 2026-09-29 41 d ago also BIT-jupyterhub-2026-54338 , EUVD-2026-54678 , GHSA-p43p-whwx-q52h , PYSEC-2026-3853
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.
Patch / fix
- pypi jupyterhub 5.5.0
- bitnami jupyterhub 5.5.0
- jupyter jupyterhub 5.5.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | jupyterhub | <5.5.0 |
5.5.0 |
| bitnami | jupyterhub | <5.5.0 |
5.5.0 |
Affected products
- jupyterhub jupyterhub
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/jupyterhub/jupyterhub/commit/d6dc595f84b7509969686da31d87d6d69e7fce0a
web
-
github.com
/jupyterhub/jupyterhub/security/advisories/GHSA-p43p-whwx-q52h
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-54338
advisory, web
-
github.com
/jupyterhub/jupyterhub
package
-
pypi.org
/project/jupyterhub
package
-
github.com
/advisories/GHSA-p43p-whwx-q52h
advisory
Sources
- CVE List CVE-2026-54338
- GitHub Advisory GHSA-p43p-whwx-q52h
- NVD CVE-2026-54338
- OSV BIT-jupyterhub-2026-54338
- OSV PYSEC-2026-3853
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.