DEBIAN-CVE-2026-40110

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-40110
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-40110.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-40110
Upstream
  • CVE-2026-40110
Published
2026-05-05T22:16:00.663Z
Modified
2026-05-12T09:00:30.271115Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against the alloworiginpat configuration value. Because re.match() only anchors at the start of the string and does not require a full match, a pattern intended to match only a trusted domain (e.g., trusted.example.com) will also match any origin that begins with that domain followed by additional characters (e.g., trusted.example.com.evil.com). An attacker who controls such a domain can bypass the CORS origin restriction and make cross-origin requests to the Jupyter Server API from an untrusted site. This issue has been fixed in version 2.18.0.

References

Affected packages

Debian:11 / jupyter-server

Package

Name
jupyter-server
Purl
pkg:deb/debian/jupyter-server?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.2.2-1
1.10.2-1
1.11.0-1
1.11.1-1
1.12.0-1
1.12.1-1
1.13.1-1
1.16.0-1
1.17.0-1
1.17.1-1
1.18.1-1
1.18.1-2
1.21.0-1
1.23.2-1
1.23.3-1
1.23.3-2
2.*
2.9.1-1
2.14.0-1
2.14.2-1
2.14.2-2
2.14.2-3
2.14.2-4
2.14.2-5
2.15.0-1
2.17.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-40110.json"

Debian:12 / jupyter-server

Package

Name
jupyter-server
Purl
pkg:deb/debian/jupyter-server?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.23.3-1
1.23.3-2
2.*
2.9.1-1
2.14.0-1
2.14.2-1
2.14.2-2
2.14.2-3
2.14.2-4
2.14.2-5
2.15.0-1
2.17.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-40110.json"

Debian:13 / jupyter-server

Package

Name
jupyter-server
Purl
pkg:deb/debian/jupyter-server?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.15.0-1
2.17.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-40110.json"

Debian:14 / jupyter-server

Package

Name
jupyter-server
Purl
pkg:deb/debian/jupyter-server?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.15.0-1
2.17.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-40110.json"