CVE-2026-7541
Full vulnerability record from the local CVENow database.
Description
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parsed user-controlled JSON request bodies without size or depth limits, causing excessive CPU and memory consumption. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18. This vulnerability was reported via the GitHub Bug Bounty program.
Severity
MEDIUM
CVSS score
6.3
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-05-07 22:16:36.917000
Last modified
2026-10-26 20:10:00.160000
View original CVE JSON
{
"id": "CVE-2026-7541",
"sourceIdentifier": "[email protected]",
"published": "2026-05-07T22:16:36.917",
"lastModified": "2026-10-26T20:10:00.160",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parsed user-controlled JSON request bodies without size or depth limits, causing excessive CPU and memory consumption. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18. This vulnerability was reported via the GitHub Bug Bounty program."
},
{
"lang": "es",
"value": "Una vulnerabilidad de denegación de servicio fue identificada en GitHub Enterprise Server que permitía a un atacante no autenticado causar una interrupción del servicio enviando solicitudes manipuladas con cargas útiles JSON profundamente anidadas a un endpoint de API no autenticado. El endpoint analizaba cuerpos de solicitud JSON controlados por el usuario sin límites de tamaño o profundidad, causando un consumo excesivo de CPU y memoria. Esta vulnerabilidad afectó a todas las versiones de GitHub Enterprise Server anteriores a la 3.21 y fue corregida en las versiones 3.20.2, 3.19.6, 3.18.9, 3.17.15 y 3.16.18. Esta vulnerabilidad fue reportada a través del programa GitHub Bug Bounty."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "GitHub",
"product": "Enterprise Server",
"defaultStatus": "affected",
"versions": [
{
"version": "3.16.0",
"lessThanOrEqual": "3.16.17",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.16.18",
"status": "unaffected"
}
]
},
{
"version": "3.17.0",
"lessThanOrEqual": "3.17.14",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.17.15",
"status": "unaffected"
}
]
},
{
"version": "3.18.0",
"lessThanOrEqual": "3.18.8",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.18.9",
"status": "unaffected"
}
]
},
{
"version": "3.19.0",
"lessThanOrEqual": "3.19.5",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.19.6",
"status": "unaffected"
}
]
},
{
"version": "3.20.0",
"lessThanOrEqual": "3.20.1",
"versionType": "semver",
"status": "affected",
"changes": [
{
"at": "3.20.2",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "UNREPORTED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-05-08T13:44:37.884506Z",
"id": "CVE-2026-7541",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.16.18",
"matchCriteriaId": "30904527-43B5-453A-A669-7845C2643965"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.17.0",
"versionEndExcluding": "3.17.15",
"matchCriteriaId": "D594E173-80DE-4EC9-9E6C-8C78A80D1402"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.0",
"versionEndExcluding": "3.18.9",
"matchCriteriaId": "2501EC91-4CD0-49F5-B76A-558EB5A5946C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.19.0",
"versionEndExcluding": "3.19.6",
"matchCriteriaId": "F2D6ABE3-EF68-4DDC-9846-9A891C859477"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.20.0",
"versionEndExcluding": "3.20.2",
"matchCriteriaId": "FC8A09E8-5FFE-43F1-BC1A-14A298264D80"
}
]
}
]
}
],
"references": [
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.16.18",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.17.15",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.18.9",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.19.6",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://docs.github.com/en/[email protected]/admin/release-notes#3.20.2",
"source": "[email protected]",
"tags": [
"Release Notes",
"Vendor Advisory"
]
}
]
}