CVE-2026-54338: falha de média gravidade em jupyterhub
JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
jupyterhub · jupyterhubCVEs relacionadas — jupyterhub
No mesmo produto, das mais perigosas para as menos.
CVE-2021-41247LOWincomplete logout in JupyterHubEPSS 0.8%CVE-2024-41942HIGHJupyterHub has a privilege escalation vulnerability with the `admin:users` scopeEPSS 0.6%CVE-2024-28233HIGHXSS in JupyterHub via Self-XSS leveraged by Cookie TossingEPSS 0.3%CVE-2026-108752LOWJupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped HyphenEPSS 0.2%CVE-2026-33709MEDIUMJupyterHub has an Open Redirect VulnerabilityEPSS 0.2%CVE-2026-40864MEDIUMJupyterHub: Cross-origin form POSTs bypass XSRFEPSS 0.1%