CVE-2026-34052: LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)
Published Apr 3, 2026
·Updated
## Summary The LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. Nonces are added before signature validation, so an attacker with knowledge of a valid consumer key can send repeated requests with unique nonces to gradually exhaust server memory, causing a denial of service. ## Patches - upgrade jupyterhub-litauthenticator to 1.6.3
Affected Software
2 affected componentsFixes available
pip/jupyterhub-ltiauthenticator<=1.6.2
1.6.3
jupyter LTI JupyterHub Authenticator<1.6.3
Event History
Apr 3, 2026
Advisory Published
via GitHub·09:42 PM
Data Sourced
via GitHub·09:42 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·10:04 PM
Data Sourced
via MITRE·10:04 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
Affected Software