CVE-2026-54338: JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login

August 25, 2026

Invalid input to login resulted in unbounded logging output. Only form-based Authenticators (the default PAM Authenticator, but not the more widely used OAuthenticator) are affected.

References

github.com/advisories/GHSA-p43p-whwx-q52h
github.com/jupyterhub/jupyterhub/commit/d6dc595f84b7509969686da31d87d6d69e7fce0a
github.com/jupyterhub/jupyterhub/security/advisories/GHSA-p43p-whwx-q52h
nvd.nist.gov/vuln/detail/CVE-2026-54338

Code Behaviors & Features

Detect and mitigate CVE-2026-54338 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →