CVE-2026-34052 LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)

🗓️ 03 Apr 2026 22:04:10Reported by GitHub_MType

Unbounded nonce storage in LTI JupyterHub Authenticator causes denial of service; fixed in 1.6.3.

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2026-34052	3 Apr 202622:04	–	attackerkb
Chainguard	CVE-2026-34052 vulnerabilities	6 Apr 202619:32	–	cgr
CNNVD	LTI JupyterHub Authenticator 安全漏洞	3 Apr 202600:00	–	cnnvd
CVE	CVE-2026-34052	3 Apr 202622:04	–	cve
EUVD	EUVD-2026-18893	3 Apr 202621:42	–	euvd
Github Security Blog	LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)	3 Apr 202621:42	–	github
NVD	CVE-2026-34052	3 Apr 202623:17	–	nvd
OSV	CGA-CR29-6366-HC95	6 Apr 202616:30	–	osv
OSV	CLEANSTART-2026-AN27706 Security fixes for CVE-2026-22815, CVE-2026-30922, CVE-2026-31958, CVE-2026-32597, CVE-2026-33175, CVE-2026-34052, CVE-2026-34073, CVE-2026-34513, CVE-2026-34514, CVE-2026-34515, CVE-2026-34516, CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525, CVE-2026-44431, CVE-2026-44432, ghsa-752w-5fwx-jx9f, ghsa-78cv-mqj4-43f7, ghsa-gc5v-m9x4-r6x2, ghsa-jr27-m4p2-rc6r, ghsa-m959-cc7f-wv43, ghsa-qjxf-f2mg-c6mc applied in versions: 4.3.2-r0, 4.3.2-r1, 4.3.2-r2, 4.3.2-r3	18 May 202613:26	–	osv
OSV	GHSA-8MXQ-7XR7-2FXJ LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)	3 Apr 202621:42	–	osv

[
  {
    "vendor": "jupyterhub",
    "product": "ltiauthenticator",
    "versions": [
      {
        "version": "< 1.6.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/jupyterhub/ltiauthenticator/security/advisories/GHSA-8mxq-7xr7-2fxj
github	www.github.com/jupyterhub/ltiauthenticator/releases/tag/1.6.3

03 Apr 2026 22:04Current

CVSS 3.15.9

EPSS0.00329