CVE-2026-34052

The LTI 1.1 validator component in jupyterhub-litauthenticator implements OAuth 1.0-based authentication for learning tools. The vulnerability stems from a resource management failure (CWE-401) where nonces used to prevent replay attacks are accumulated in a class-level dictionary without a cleanup mechanism or size limit. Because nonces are stored before cryptographic signature validation, an attacker does not need to forge valid signatures-they only need to know a legitimate consumer key (typically configured publicly) to generate requests that populate the nonce dictionary indefinitely. Each unique nonce consumes memory until the process is exhausted, triggering a denial of service. This impacts any JupyterHub deployment using ltiauthenticator for LTI-based single sign-on integration, which is common in educational environments.