jupyterhub/ltiauthenticator · Security
LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)
- GHSA ID
- GHSA-8mxq-7xr7-2fxj
- CVE ID
- CVE-2026-34052
- Severity
- medium
- Published
- Updated
- CVSS
- 5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 5.9 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Summary
The LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. Nonces are added before signature validation, so an attacker with knowledge of a valid consumer key can send repeated requests with unique nonces to gradually exhaust server memory, causing a denial of service.
Patches
- upgrade jupyterhub-litauthenticator to 1.6.3
CWEs
- CWE-401 · Missing Release of Memory after Effective Lifetime
- CWE-770 · Allocation of Resources Without Limits or Throttling