MEDIUM 5.3

GHSA-p43p-whwx-q52h

JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

Quick fix

GHSA-p43p-whwx-q52h — jupyterhub: upgrade to the fixed version with the command below.

pip install --upgrade 'jupyterhub>=5.5.0'

Details

### Impact

Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected.

### Patches

Upgrade to 5.5.0.

### Workarounds

Use an Authenticator that doesn't use a login form, such as OAuthenticator.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI / jupyterhub

Introduced in: 0 Fixed in: 5.5.0

Fix pip install --upgrade 'jupyterhub>=5.5.0'

References

https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-p43p-whwx-q52h [WEB]
https://nvd.nist.gov/vuln/detail/CVE-2026-54338 [ADVISORY]
https://github.com/jupyterhub/jupyterhub/commit/d6dc595f84b7509969686da31d87d6d69e7fce0a [WEB]
https://github.com/jupyterhub/jupyterhub [PACKAGE]