Executive brief
JupyterHub is a multi-user notebook server that allows organizations to host Jupyter Notebook environments for multiple users. A flaw in the login handling of form-based authentication mechanisms (such as the default PAM authenticator) allows an unauthenticated attacker to send specially crafted login requests that trigger unbounded logging output, consuming server resources and potentially rendering the service unavailable. This affects only form-based authenticators; organizations using OAuth-based authentication are not impacted.
Technical details
The vulnerability is an uncontrolled resource consumption flaw (CWE-400) in JupyterHub's form-based login processing. When an invalid username is submitted to the login form, the application logs the input without proper bounds or sanitization, allowing an attacker to craft extremely long or malicious usernames that generate unbounded logging output. An unauthenticated attacker on the network can exploit this via the login endpoint with no authentication required and no user interaction needed. Successful exploitation exhausts disk space or I/O resources used for logging, degrading availability. The vulnerability is fixed in version 5.5.0; organizations using OAuthenticator or other non-form-based authenticators are unaffected and do not require patching.
Affected products
- JupyterHub JupyterHub < 5.5.0
Timeline
- 2026-07-18: disclosed
- 2026-08-07: patched: Published by NVD
- 2026-08-25: advisory: GitHub Advisory published