Is CVE-2026-54338 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54338 being exploited in the wild.

How severe is CVE-2026-54338?

Medium severity, with a CVSS score of 5.3, published 25 August 2026.

Which products and versions are affected?

jupyterhub (PyPI) < 5.5.0, ECOSYSTEM:introduced=0,fixed=5.5.0.

Is there a fix for CVE-2026-54338?

Yes. jupyterhub (PyPI): upgrade to 5.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54338 attacked?

It is attacked over the network.

Am I affected by CVE-2026-54338?

Check whether you run jupyterhub (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54338: JupyterHub unauthenticated denial of service in login form handling

Q: Which products and versions are affected?

jupyterhub (PyPI) < 5.5.0, ECOSYSTEM:introduced=0,fixed=5.5.0.

Q: Is there a fix for CVE-2026-54338?

Yes. jupyterhub (PyPI): upgrade to 5.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54338 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-54338?

Check whether you run jupyterhub (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54338 · Severity: medium · CVSS 5.3 · Published 2026-08-25

JupyterHub is a multi-user notebook server that allows organizations to host Jupyter Notebook environments for multiple users. A flaw in the login handling of form-based authentication mechanisms (such as the default PAM authenticator) allows an unauthenticated attacker to send specially crafted login requests that trigger unbounded logging output, consuming server resources and potentially rendering the service unavailable. This affects only form-based authenticators; organizations using OAuth-based authentication are not impacted.

Technologies: jupyterhub (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54338 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54338 being exploited in the wild.
How severe is CVE-2026-54338?: Medium severity, with a CVSS score of 5.3, published 25 August 2026.
Which products and versions are affected?: jupyterhub (PyPI) < 5.5.0, ECOSYSTEM:introduced=0,fixed=5.5.0.
Is there a fix for CVE-2026-54338?: Yes. jupyterhub (PyPI): upgrade to 5.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54338 attacked?: It is attacked over the network.
Am I affected by CVE-2026-54338?: Check whether you run jupyterhub (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

jupyterhub (PyPI): upgrade to 5.5.0 or later
```
pip install "jupyterhub>=5.5.0"
```

Technical details

The vulnerability is an uncontrolled resource consumption flaw (CWE-400) in JupyterHub's form-based login processing. When an invalid username is submitted to the login form, the application logs the input without proper bounds or sanitization, allowing an attacker to craft extremely long or malicious usernames that generate unbounded logging output. An unauthenticated attacker on the network can exploit this via the login endpoint with no authentication required and no user interaction needed. Successful exploitation exhausts disk space or I/O resources used for logging, degrading availability. The vulnerability is fixed in version 5.5.0; organizations using OAuthenticator or other non-form-based authenticators are unaffected and do not require patching.

Affected products

JupyterHub JupyterHub < 5.5.0

Identifiers

CVE-2026-54338
GHSA-p43p-whwx-q52h
PYSEC-2026-3853

Timeline

2026-07-18: disclosed
2026-08-07: patched: Published by NVD
2026-08-25: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.