CVE-2026-34052: jupyter lti_jupyterhub_authenticator
Vulnerability summary
CVE-2026-34052 is a medium (CVSS 5.9) vulnerability in jupyter lti_jupyterhub_authenticator. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 03-04-2026PublishedVulnerability first disclosed.
- 06-04-2026Last modifiedVulnerability information updated.
Description
LTI JupyterHub Authenticator is a JupyterHub authenticator for LTI. Prior to version 1.6.3, the LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. Nonces are added before signature validation, so an attacker with knowledge of a valid consumer key can send repeated requests with unique nonces to gradually exhaust server memory, causing a denial of service. This issue has been patched in version 1.6.3.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · PypiEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
+0.08 pp
From 0.33% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Chainguard4 products
- py3.10-jupyterhub-ltiauthenticator< 1.6.3-r0
- py3.11-jupyterhub-ltiauthenticator< 1.6.3-r0
- py3.12-jupyterhub-ltiauthenticator< 1.6.3-r0
- py3.13-jupyterhub-ltiauthenticator< 1.6.3-r0
Wolfi4 products
- py3.10-jupyterhub-ltiauthenticator< 1.6.3-r0
- py3.11-jupyterhub-ltiauthenticator< 1.6.3-r0
- py3.12-jupyterhub-ltiauthenticator< 1.6.3-r0
- py3.13-jupyterhub-ltiauthenticator< 1.6.3-r0
Jupyter1 product
- lti_jupyterhub_authenticator< 1.6.3
Jupyterhub1 product
- ltiauthenticator< 1.6.3
PyPI1 product
- jupyterhub-ltiauthenticator< 1.6.3
5 vendors · 11 products
References
7 links- github.com/jupyterhub/ltiauthenticator/security/advisories/GHSA-8mxq-7xr7-2fxjX Refsource CONFIRMWEBAdvisoryVendor Advisory
