The flaw allows an unauthenticated attacker to submit arbitrarily long usernames to the form‑based login mechanism of JupyterHub. Each failed login attempt is recorded in the server logs without input length checks, causing the log file to grow without bound and eventually consume disk space and I/O resources. The failure to bound user input is a classic resource exhaustion weakness (CWE‑400).

JupyterHub software before version 5.5.0 is affected. The issue has been fixed in release 5.5.0, so any installation of JupyterHub older than 5.5.0 is vulnerable.

The CVSS score is 5.3, indicating moderate severity, and no EPSS score is available, so the current exploitation probability is unknown. The vulnerability is not listed in CISA KEV. The attack vector is likely remote via the public login endpoint; an attacker does not need any prior authentication and can trigger the log flooding by repeatedly attempting logins with long usernames.