CVE-2026-54338 — JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

Description

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.

Affected products

Vendor	Product	Affected	Fixed
jupyterhub	jupyterhub	< 5.5.0JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and…	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	jupyterhub	No fix yet	—
Debian 13	jupyterhub	No fix yet	—
Debian 12	jupyterhub	No fix yet	—

Ubuntu