PT-2026-30253 · Unknown · Ltiauthenticator+1

Yueyuel · Published 2026-04-03 · Updated 2026-05-18 · CVE-2026-34052

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions LTI JupyterHub Authenticator versions prior to 1.6.3

Description The LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. Nonces are added before signature validation, allowing an attacker with a valid consumer key to send repeated requests with unique nonces, gradually exhausting server memory and causing a denial of service.

Recommendations Upgrade to version 1.6.3 or later.

Fix

Memory Leak

Allocation of Resources Without Limits

Weakness Enumeration

CWE-401

CWE-770

Related Identifiers

CLEANSTART-2026-AN27706

CVE-2026-34052

GHSA-8MXQ-7XR7-2FXJ

Affected Products

Jupyterhub

Ltiauthenticator

References · 48

• https://github.com/jupyterhub/ltiauthenticator/security/advisories/GHSA-8mxq-7xr7-2fxj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34514 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-30922 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34517 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44431 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34513 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34073 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44432 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33175 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34052 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34520 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-34519 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-AN27706 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22815 · Security Note