CVE-2026-34052
Medium · 5.9CVSS
5.9
EPSS
0.4%
Published
Apr 3, 2026
CISA due date
—
The record
LTI JupyterHub Authenticator is a JupyterHub authenticator for LTI. Prior to version 1.6.3, the LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. Nonces are added before signature validation, so an attacker with knowledge of a valid consumer key can send repeated requests with unique nonces to gradually exhaust server memory, causing a denial of service. This issue has been patched in version 1.6.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | py3.10-jupyterhub-ltiauthenticator | 0 | 1.6.3-r0 |
| Chainguard | py3.11-jupyterhub-ltiauthenticator | 0 | 1.6.3-r0 |
| Chainguard | py3.12-jupyterhub-ltiauthenticator | 0 | 1.6.3-r0 |
| Chainguard | py3.13-jupyterhub-ltiauthenticator | 0 | 1.6.3-r0 |
| Wolfi | py3.10-jupyterhub-ltiauthenticator | 0 | 1.6.3-r0 |
| Wolfi | py3.11-jupyterhub-ltiauthenticator | 0 | 1.6.3-r0 |
| Wolfi | py3.12-jupyterhub-ltiauthenticator | 0 | 1.6.3-r0 |
| Wolfi | py3.13-jupyterhub-ltiauthenticator | 0 | 1.6.3-r0 |
Related vulnerabilities
- CVE-2026-109278 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the… CWE-401
- CVE-2026-109270 ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option… CWE-401
- CVE-2026-109262 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG… CWE-401
- CVE-2026-109263 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the YUV… CWE-401
- CVE-2026-109261 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF… CWE-401
- CVE-2026-109260 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG… CWE-401
- CVE-2026-104874 Multidict is an implementation of a multidict data structure. CWE-401
- CVE-2026-98162 In the Linux kernel, the following vulnerability has been resolved: smb/server: fix tree… CWE-401