Hi,

The following vulnerability was published for jupyterhub.

CVE-2026-54338[0]:
| JupyterHub is software that allows users to create a multi-user
| server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-
| based login authenticators can place an unbounded attacker-
| controlled username in failed-login logs, allowing an
| unauthenticated attacker to consume logging and storage resources.
| This issue is fixed in version 5.5.0.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-54338
https://www.cve.org/CVERecord?id=CVE-2026-54338
[1] https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-p43p-whwx-q52h
[2] https://github.com/jupyterhub/jupyterhub/commit/d6dc595f84b7509969686da31d87d6d69e7fce0a

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore