Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-7541

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parsed user-controlled JSON request bodies without size or depth limits, causing excessive CPU and memory consumption. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6,
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:03c308eaae1f79e23a7f33a27b881965d215a425603a8d76c57b8b66758b6212
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"defaultStatus":"affected","product":"Enterprise Server","vendor":"GitHub","versions":[{"changes":[{"at":"3.16.18","status":"unaffected"}],"lessThanOrEqual":"3.16.17","status":"affected","version":"3.16.0","versionType":"semver"},{"changes":[{"at":"3.17.15","status":"unaffected"}],"lessThanOrEqual":"3.17.14","status":"affected","version":"3.17.0","versionType":"semver"},{"changes":[{"at":"3.18.9","status":"unaffected"}],"lessThanOrEqual":"3.18.8","status":"affected","version":"3.18.0","versionType":"semver"},{"changes":[{"at":"3.19.6","status":"unaffected"}],"lessThanOrEqual":"3.19.5","status…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:ffe826a6832301c9fe99a5751d2a4d27a6b08a6f4566c727b42935b4e49383f3 · sha256:6bd958d4f7b7f638… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":6.3,"baseSeverity":"MEDIUM","exploitMaturity":"UNREPORTED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityI…
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:ffe826a6832301c9fe99a5751d2a4d27a6b08a6f4566c727b42935b4e49383f3 · sha256:6bd958d4f7b7f638… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-770","description":"CWE-770 Allocation of resources without limits or throttling","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:ffe826a6832301c9fe99a5751d2a4d27a6b08a6f4566c727b42935b4e49383f3 · sha256:6bd958d4f7b7f638… · /containers/cna/problemTypes/0/descriptions/0

Source references

5 source assertions
{"tags":["release-notes"],"url":"https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ffe826a6832301c9fe99a5751d2a4d27a6b08a6f4566c727b42935b4e49383f3 · sha256:6bd958d4f7b7f638… · /containers/cna/references/0
{"tags":["release-notes"],"url":"https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ffe826a6832301c9fe99a5751d2a4d27a6b08a6f4566c727b42935b4e49383f3 · sha256:6bd958d4f7b7f638… · /containers/cna/references/1
{"tags":["release-notes"],"url":"https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ffe826a6832301c9fe99a5751d2a4d27a6b08a6f4566c727b42935b4e49383f3 · sha256:6bd958d4f7b7f638… · /containers/cna/references/2
{"tags":["release-notes"],"url":"https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ffe826a6832301c9fe99a5751d2a4d27a6b08a6f4566c727b42935b4e49383f3 · sha256:6bd958d4f7b7f638… · /containers/cna/references/3
{"tags":["release-notes"],"url":"https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ffe826a6832301c9fe99a5751d2a4d27a6b08a6f4566c727b42935b4e49383f3 · sha256:6bd958d4f7b7f638… · /containers/cna/references/4

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer