Input validation error in jupyterhub - #VU162717
Published: November 9, 2026
Vulnerability identifier: #VU162717
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker with low privileges to cause a denial of service that prevents JupyterHub launches.
The vulnerability exists due to improper handling of certain invalid user input in JupyterHub spawner options that leaves invalid data in the database. A remote authenticated attacker with low privileges can submit these invalid options and prevent subsequent launches until manual database intervention removes the invalid data.
Affected software
jupyterhub
Remediation
Install security update from vendor's website.
jupyterhub - addressed in versions 5.5.3, 6.1.0