EXECUTIVE SUMMARY:
A medium-severity vulnerability, identified as CVE-2026-54338 with a CVSS score of 5.3, affects JupyterHub's authentication logging mechanism by causing excessive and unbounded logging output when invalid input is provided during login attempts via form-based authenticators such as the default PAM Authenticator, while excluding OAuthenticator. This flaw allows an unauthenticated attacker to cause a denial-of-service condition through unbounded username logging on failed login attempts, potentially resulting in resource exhaustion and service disruption. The attack is network-based, requires low attack complexity, no privileges, and no user interaction.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
A medium-severity vulnerability, identified as CVE-2026-54338 with a CVSS score of 5.3, affects JupyterHub's authentication logging mechanism by causing excessive and unbounded logging output when invalid input is provided during login attempts via form-based authenticators such as the default PAM Authenticator, while excluding OAuthenticator. This flaw allows an unauthenticated attacker to cause a denial-of-service condition through unbounded username logging on failed login attempts, potentially resulting in resource exhaustion and service disruption. The attack is network-based, requires low attack complexity, no privileges, and no user interaction.[emaillocker id="1283"]
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-p43p-whwx-q52h