CVE-2026-34052 LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)
An attacker can exhaust server memory by sending repeated requests with unique nonces, causing a denial of service in the LTI JupyterHub Authenticator.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34052?
CVE-2026-34052 is a medium-severity denial of service vulnerability in jupyterhub ltiauthenticator, published on 3 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LTI JupyterHub Authenticator is a JupyterHub authenticator for LTI. Prior to version 1.6.3, the LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. Nonces are added before signature validation, so an attacker with knowledge of a valid consumer key can send repeated requests with unique nonces to gradually exhaust server memory, causing a denial of service. This issue has been patched in version 1.6.3.
Which versions are affected by CVE-2026-34052?
3 open source packages ship an affected version, including jupyterhub-ltiauthenticator. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jupyterhub-ltiauthenticator PyPI | All versions | 1.6.3 |
jupyterhub-ltiauthenticator PyPI | All versions | 1.6.3 |
jupyterhub-ltiauthenticator PyPI | All versions | 1.6.3 |
Products include Jupyter Lti Jupyterhub Authenticator.
How do I fix CVE-2026-34052?
Upgrade jupyterhub-ltiauthenticator to 1.6.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-34052 being exploited?
There is no known exploitation of CVE-2026-34052 in the wild and no public exploit code.
Other vulnerabilities in jupyterhub ltiauthenticator
Sources
Also known as CLEANSTART-2026-WX65723, GHSA-8mxq-7xr7-2fxj, PYSEC-2026-2533.