What is GHSA-8mxq-7xr7-2fxj?

GHSA-8mxq-7xr7-2fxj is a security advisory published by GitHub Security Advisories with Medium severity. LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)

Which CVE IDs does GHSA-8mxq-7xr7-2fxj cover?

GHSA-8mxq-7xr7-2fxj covers the following CVE IDs: CVE-2026-34052. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8mxq-7xr7-2fxj?

GHSA-8mxq-7xr7-2fxj has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-8mxq-7xr7-2fxj?

GHSA-8mxq-7xr7-2fxj affects 1 product, including: pip/jupyterhub-ltiauthenticator:\u003c= 1.6.2.

GHSA-8mxq-7xr7-2fxjMediumCVSS 5.9

LTI JupyterHub Authenticator: Unbounded Memory Growth via Nonce Storage (Denial of Service)

Vendor

GitHub Security Advisories

Published

April 3, 2026

Last Modified

April 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-34052 →

📋 Description

Summary

The LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. Nonces are added before signature validation, so an attacker with knowledge of a valid consumer key can send repeated requests with unique nonces to gradually exhaust server memory, causing a denial of service.

Patches

upgrade jupyterhub-litauthenticator to 1.6.3

🎯 Affected products1

pip/jupyterhub-ltiauthenticator:<= 1.6.2

🔗 References (4)

https://github.com/jupyterhub/ltiauthenticator/security/advisories/GHSA-8mxq-7xr7-2fxj
https://nvd.nist.gov/vuln/detail/CVE-2026-34052
https://github.com/jupyterhub/ltiauthenticator/releases/tag/1.6.3
https://github.com/advisories/GHSA-8mxq-7xr7-2fxj