DEBIAN-CVE-2026-33709

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-33709
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33709.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-33709
Upstream
  • CVE-2026-33709
Published
2026-04-03T22:16:26.657Z
Modified
2026-04-04T10:04:09.237260Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. This issue has been patched in version 5.4.4.

References

Affected packages

Debian:12 / jupyterhub

Package

Name
jupyterhub
Purl
pkg:deb/debian/jupyterhub?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.0.0+ds1-1
5.*
5.0.0+ds1-1
5.0.0+ds1-2
5.0.0+ds1-3
5.0.0+ds1-4
5.2.1+ds1-1
5.2.1+ds1-2
5.2.1+ds1-3
5.2.1+ds1-4
5.2.1+ds1-5

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33709.json"

Debian:13 / jupyterhub

Package

Name
jupyterhub
Purl
pkg:deb/debian/jupyterhub?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

5.*
5.2.1+ds1-4
5.2.1+ds1-5

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33709.json"

Debian:14 / jupyterhub

Package

Name
jupyterhub
Purl
pkg:deb/debian/jupyterhub?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

5.*
5.2.1+ds1-4
5.2.1+ds1-5

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-33709.json"