PT-2026-38593 · Github · Github Enterprise Server

Published 2026-05-07 · Updated 2026-05-10 · CVE-2026-7541

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21

Description An unauthenticated attacker can cause service disruption by sending crafted requests containing deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parses user-controlled JSON request bodies without size or depth limits, leading to excessive CPU and memory consumption, which results in a denial of service (a condition where a system becomes unavailable to its intended users).

Recommendations Update to version 3.20.2, 3.19.6, 3.18.9, 3.17.15, or 3.16.18.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-7541

Affected Products

Github Enterprise Server

References · 9

• https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7541 · Security Note
• https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9 · Vendor Advisory
• https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18 · Vendor Advisory
• https://t.me/CVEtracker/53041 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2052601915465191690 · Twitter Post
• https://twitter.com/CVEnew/status/2053559188907815376 · Twitter Post