CVE-2026-34052 jupyterhub CVE debrief

Who should care

Users of Jupyter LTI JupyterHub Authenticator before version 1.6.3 should update to the patched version to prevent potential denial of service attacks. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess and mitigate this vulnerability.

Technical summary

The LTI JupyterHub Authenticator vulnerability CVE-2026-34052 is a denial of service issue. Prior to version 1.6.3, the LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. This allows an attacker with knowledge of a valid consumer key to send repeated requests with unique nonces, gradually exhausting server memory. The issue has been patched in version 1.6.3. Defenders should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Defensive priority

Medium priority given the CVSS score of 5.9 and the potential for denial of service attacks.

Recommended defensive actions

• Update LTI JupyterHub Authenticator to version 1.6.3 or later
• Restrict access to the authenticator to trusted users
• Monitor server memory usage for signs of exhaustion
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail provide evidence of the vulnerability and its patch. The source item URL provides additional information on the vulnerability. Evidence is limited, so defenders should verify affected scope and vendor guidance with caution. The LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds, allowing an attacker with knowledge of a valid consumer key to send repeated requests with unique nonces, gradually exhausting server memory. This issue has been patched in version 1.6.3. Defenders should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Official resources