MEDIUM5.3

PYSEC-2026-3853

JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

Quick fix

PYSEC-2026-3853 — jupyterhub: upgrade to the fixed version with the command below.

pip install --upgrade 'jupyterhub>=5.5.0'

Details

### Impact

Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected.

### Patches

Upgrade to 5.5.0.

### Workarounds

Use an Authenticator that doesn't use a login form, such as OAuthenticator.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/jupyterhub

Introduced in: 0Fixed in: 5.5.0

Fixpip install --upgrade 'jupyterhub>=5.5.0'

References

https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-p43p-whwx-q52h[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2026-54338[ADVISORY]
https://github.com/jupyterhub/jupyterhub/commit/d6dc595f84b7509969686da31d87d6d69e7fce0a[WEB]
https://github.com/jupyterhub/jupyterhub[PACKAGE]
https://pypi.org/project/jupyterhub[PACKAGE]
https://github.com/advisories/GHSA-p43p-whwx-q52h[ADVISORY]