Riskcovery

CVE-2026-7541

Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint

State
Published
Severity
6.3 Medium
Published
May 7, 2026
Updated
May 8, 2026
Reserved
Apr 30, 2026

Read the record on cve.org

Description

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parsed user-controlled JSON request bodies without size or depth limits, causing excessive CPU and memory consumption. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18. This vulnerability was reported via the GitHub Bug Bounty program.

Scores

CVSSScoreVectorSource
4.06.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:UGitHub_P

Weaknesses

  • CWE-770 Allocation of resources without limits or throttling

Affected Products

ProductVersions
Enterprise ServerGitHub
  • 3.16.0 through 3.16.17Affectedfrom 3.16.18Not affected
  • 3.17.0 through 3.17.14Affectedfrom 3.17.15Not affected
  • 3.18.0 through 3.18.8Affectedfrom 3.18.9Not affected
  • 3.19.0 through 3.19.5Affectedfrom 3.19.6Not affected
  • 3.20.0 through 3.20.1Affectedfrom 3.20.2Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.