Description

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources. This issue is fixed in version 5.5.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-07T21:17:29.017Z",
  "pubdate": "2026-08-07T21:17:29.017Z",
  "executiveSummary": "JupyterHub prior to version 5.5.0 contains a vulnerability involving form-based login authenticators that fails to properly sanitize or bound input supplied during authentication attempts. This deficiency allows an unauthenticated remote attacker to submit maliciously crafted, excessively large, or otherwise invalid usernames via the login interface.\nThe primary impact of this behavior is resource exhaustion, specifically targeting system logging facilities and underlying storage media. By continuously submitting invalid credentials containing unbounded strings, an adversary can rapidly consume available disk space and log buffer resources, potentially leading to denial of service conditions for the affected system.\nThe vulnerability affects JupyterHub deployments utilizing form-based login mechanisms. Exploitation requires no prior authentication or privileged access, meaning any external network-connected attacker can initiate the attack flow. The risk implication centers on operational availability and storage integrity, as unconstrained log inflation can degrade or crash the host system.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling and logging of user-supplied input within form-based login authenticators in JupyterHub prior to version 5.5.0. When an authentication attempt fails using the form-based authenticator, the application writes the provided username directly to the failed-login logs.\nBecause the input is neither truncated nor validated for length or structural integrity prior to logging, an attacker can supply arbitrarily large payloads within the username parameter.\nThe vulnerable component is the authentication logging subsystem associated with form-based login handlers in JupyterHub. The affected versions include all releases prior to 5.5.0. Exploitation does not require authentication, privileges, or complex interaction; the attack vector is exposed over the network via standard HTTP/HTTPS endpoints handling authentication requests.\nThe step-by-step attack flow proceeds as follows: First, the unauthenticated attacker crafts an HTTP POST request targeted at the JupyterHub login endpoint. Second, the attacker populates the username field with an unbounded string consisting of thousands or millions of characters or binary data. Third, the form-based authenticator processes the request and rejects the invalid credentials. Fourth, the application attempts to record the failed login event, appending the unbounded attacker-controlled username string to the logging mechanism. Fifth, repeated transmission of these crafted requests results in exponential growth of log file sizes, exhausting disk I/O, storage capacity, and potentially locking system resources.\nPost-exploitation impact is strictly aligned with denial of service through resource exhaustion. The unbounded logging behavior forces the operating system to allocate excessive disk space for log storage, which can disrupt other critical services running on the same host partition and hinder administrative response capabilities."
}