CVE-2026-7541

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7541", "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "state": "PUBLISHED", "assignerShortName": "GitHub_P", "dateReserved": "2026-04-30T18:42:48.142Z", "datePublished": "2026-05-07T21:18:35.655Z", "dateUpdated": "2026-05-08T13:44:52.426Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "shortName": "GitHub_P", "dateUpdated": "2026-05-07T21:18:35.655Z"}, "title": "Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-770", "description": "CWE-770 Allocation of resources without limits or throttling", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-229", "descriptions": [{"lang": "en", "value": "CAPEC-229 Serialized Data Parameter Blowup"}]}], "affected": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "version": "3.16.0", "lessThanOrEqual": "3.16.17", "changes": [{"at": "3.16.18", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.17.0", "lessThanOrEqual": "3.17.14", "changes": [{"at": "3.17.15", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.18.0", "lessThanOrEqual": "3.18.8", "changes": [{"at": "3.18.9", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.19.0", "lessThanOrEqual": "3.19.5", "changes": [{"at": "3.19.6", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.20.0", "lessThanOrEqual": "3.20.1", "changes": [{"at": "3.20.2", "status": "unaffected"}], "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parsed user-controlled JSON request bodies without size or depth limits, causing excessive CPU and memory consumption. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18. This vulnerability was reported via the GitHub Bug Bounty program.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parsed user-controlled JSON request bodies without size or depth limits, causing excessive CPU and memory consumption. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18. This vulnerability was reported via the GitHub Bug Bounty program."}]}], "references": [{"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2", "tags": ["release-notes"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U"}}], "credits": [{"lang": "en", "value": "Nguyen Nhat Anh (GitHub: anh2025)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-08T13:44:37.884506Z", "id": "CVE-2026-7541", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T13:44:52.426Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7541", "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "state": "PUBLISHED", "assignerShortName": "GitHub_P", "dateReserved": "2026-04-30T18:42:48.142Z", "datePublished": "2026-05-07T21:18:35.655Z", "dateUpdated": "2026-05-08T13:44:52.426Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "shortName": "GitHub_P", "dateUpdated": "2026-05-07T21:18:35.655Z"}, "title": "Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpoint", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-770", "description": "CWE-770 Allocation of resources without limits or throttling", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-229", "descriptions": [{"lang": "en", "value": "CAPEC-229 Serialized Data Parameter Blowup"}]}], "affected": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "version": "3.16.0", "lessThanOrEqual": "3.16.17", "changes": [{"at": "3.16.18", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.17.0", "lessThanOrEqual": "3.17.14", "changes": [{"at": "3.17.15", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.18.0", "lessThanOrEqual": "3.18.8", "changes": [{"at": "3.18.9", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.19.0", "lessThanOrEqual": "3.19.5", "changes": [{"at": "3.19.6", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.20.0", "lessThanOrEqual": "3.20.1", "changes": [{"at": "3.20.2", "status": "unaffected"}], "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parsed user-controlled JSON request bodies without size or depth limits, causing excessive CPU and memory consumption. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18. This vulnerability was reported via the GitHub Bug Bounty program.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parsed user-controlled JSON request bodies without size or depth limits, causing excessive CPU and memory consumption. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18. This vulnerability was reported via the GitHub Bug Bounty program."}]}], "references": [{"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2", "tags": ["release-notes"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U"}}], "credits": [{"lang": "en", "value": "Nguyen Nhat Anh (GitHub: anh2025)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7541", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-08T13:44:37.884506Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-08T13:44:46.536Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Enterprise Server", "vendor": "GitHub", "versions": [{"changes": [{"at": "3.16.18", "status": "unaffected"}], "lessThanOrEqual": "3.16.17", "status": "affected", "version": "3.16.0", "versionType": "semver"}, {"changes": [{"at": "3.17.15", "status": "unaffected"}], "lessThanOrEqual": "3.17.14", "status": "affected", "version": "3.17.0", "versionType": "semver"}, {"changes": [{"at": "3.18.9", "status": "unaffected"}], "lessThanOrEqual": "3.18.8", "status": "affected", "version": "3.18.0", "versionType": "semver"}, {"changes": [{"at": "3.19.6", "status": "unaffected"}], "lessThanOrEqual": "3.19.5", "status": "affected", "version": "3.19.0", "versionType": "semver"}, {"changes": [{"at": "3.20.2", "status": "unaffected"}], "lessThanOrEqual": "3.20.1", "status": "affected", "version": "3.20.0", "versionType": "semver"}]}], "source": "product-cna@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "30904527-43B5-453A-A669-7845C2643965", "versionEndExcluding": "3.16.18", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "D594E173-80DE-4EC9-9E6C-8C78A80D1402", "versionEndExcluding": "3.17.15", "versionStartIncluding": "3.17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "2501EC91-4CD0-49F5-B76A-558EB5A5946C", "versionEndExcluding": "3.18.9", "versionStartIncluding": "3.18.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "F2D6ABE3-EF68-4DDC-9846-9A891C859477", "versionEndExcluding": "3.19.6", "versionStartIncluding": "3.19.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "FC8A09E8-5FFE-43F1-BC1A-14A298264D80", "versionEndExcluding": "3.20.2", "versionStartIncluding": "3.20.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parsed user-controlled JSON request bodies without size or depth limits, causing excessive CPU and memory consumption. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18. This vulnerability was reported via the GitHub Bug Bounty program."}, {"lang": "es", "value": "Una vulnerabilidad de denegaci\u00f3n de servicio fue identificada en GitHub Enterprise Server que permit\u00eda a un atacante no autenticado causar una interrupci\u00f3n del servicio enviando solicitudes manipuladas con cargas \u00fatiles JSON profundamente anidadas a un endpoint de API no autenticado. El endpoint analizaba cuerpos de solicitud JSON controlados por el usuario sin l\u00edmites de tama\u00f1o o profundidad, causando un consumo excesivo de CPU y memoria. Esta vulnerabilidad afect\u00f3 a todas las versiones de GitHub Enterprise Server anteriores a la 3.21 y fue corregida en las versiones 3.20.2, 3.19.6, 3.18.9, 3.17.15 y 3.16.18. Esta vulnerabilidad fue reportada a trav\u00e9s del programa GitHub Bug Bounty."}], "id": "CVE-2026-7541", "lastModified": "2026-10-26T20:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "product-cna@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7541", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-08T13:44:37.884506Z", "version": "2.0.3"}}]}, "published": "2026-05-07T22:16:36.917", "references": [{"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18"}, {"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15"}, {"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9"}, {"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6"}, {"source": "product-cna@github.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2"}], "sourceIdentifier": "product-cna@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "product-cna@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.16.0,3.16.17]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.17.0,3.17.14]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.18.0,3.18.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.19.0,3.19.5]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.20.0,3.20.1]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[3.16.18,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Enterprise Server", "source": "cna", "vendor": "GitHub"}, "product": "enterprise_server", "vendor": "github"}], "created": "2026-05-07T22:30:35.824987+00:00", "updated": "2026-05-07T23:00:09.402285+00:00", "vendors": ["github", "github$PRODUCT$enterprise_server"]}