CVE-2026-34052
CVE-2026-34052 · LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)
This page contains facts from public vulnerability sources. Check the original advisory before updating.
LTI JupyterHub Authenticator is a JupyterHub authenticator for LTI. Prior to version 1.6.3, the LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. Nonces are added before signature validation, so an attacker with knowledge of a valid consumer key can send repeated requests with unique nonces to gradually exhaust server memory, causing a denial of service. This issue has been patched in version 1.6.3.
CVSS 5.9 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
ltiauthenticator
- Versions
- < 1.6.3: Affected
No fix published
jupyterhub-ltiauthenticator PyPI
- Versions
- 0.1
- 0.2
- 0.3
- 0.4.0
- 1.0.0
- 1.1.0
- 1.2.0
- 1.3.0
- 1.4.0
- 1.5.0
- 1.5.1
- 1.6.0
- 1.6.1
- 1.6.2
- Affected ranges
- ECOSYSTEM: < 1.6.3
Update to 1.6.3