PT-2026-30253

CVE-2026-34052

Published

2026-04-03

Updated

2026-09-18

Description by

CVSS 3.1

5.9

Medium

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LTI JupyterHub Authenticator versions prior to 1.6.3

Description The LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. Nonces are added before signature validation, allowing an attacker with a valid consumer key to send repeated requests with unique nonces, gradually exhausting server memory and causing a denial of service.

Recommendations Upgrade to version 1.6.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Yueyuel

Vendors

Affected products

Weakness enumeration

CWE-401: Missing Release of Memory after Effective Lifetime

CWE-770: Allocation of Resources Without Limits or Throttling