Vulnerabilities ›

CVE-2026-7541

High

CWE-770 — Weakness Type

                    Published: May 7, 2026                      ·  Modified: May 14, 2026                      ·  Source: NVD                

CVSS v3

7.5

🔗 NVD Official

📄 Description (English)

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parsed user-controlled JSON request bodies without size or depth limits, causing excessive CPU and memory consumption. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18. This vulnerability was reported via the GitHub Bug Bounty program.

🤖 AI Executive Summary

A denial of service vulnerability in GitHub Enterprise Server allows unauthenticated attackers to cause service disruption through deeply nested JSON payloads sent to unprotected API endpoints. The vulnerability exploits insufficient input validation on JSON parsing, leading to excessive resource consumption across affected versions prior to 3.21.

📄 Description (Arabic)

تؤثر هذه الثغرة على جميع إصدارات GitHub Enterprise Server السابقة للإصدار 3.21 وتسمح للمهاجمين غير المصرح لهم بإرسال طلبات JSON متداخلة بعمق إلى نقاط نهاية API غير محمية. يؤدي الافتقار إلى حدود حجم وعمق في معالجة JSON إلى استهلاك مفرط للموارد وتعطل الخدمة.

🤖 ملخص تنفيذي (AI)

GitHub Enterprise Server contains a DoS vulnerability affecting unauthenticated API endpoints that parse JSON without depth or size restrictions. Attackers can exploit this by sending crafted nested JSON requests to consume excessive CPU and memory resources, disrupting service availability.

🤖 AI Intelligence Analysis Analyzed: May 12, 2026 15:02

🇸🇦 Saudi Arabia Impact Assessment

Saudi Relevance: high

🏢 Affected Saudi Sectors

government telecom banking

🎯 MITRE ATT&CK Techniques

T1499.004 T1561.002

⚖️ Saudi Risk Score (AI)

7.0

/ 10.0

🔧 Remediation Steps (English)

Upgrade GitHub Enterprise Server to version 3.20.2, 3.19.6, 3.18.9, 3.17.15, 3.16.18 or later. Implement network-level rate limiting and request size restrictions on API endpoints. Deploy Web Application Firewall (WAF) rules to detect and block deeply nested JSON payloads. Monitor API endpoint resource consumption for anomalies.

🔧 خطوات المعالجة (العربية)

قم بترقية GitHub Enterprise Server إلى الإصدار 3.20.2 أو 3.19.6 أو 3.18.9 أو 3.17.15 أو 3.16.18 أو أحدث. طبق تحديد معدل على مستوى الشبكة وقيود حجم الطلب على نقاط نهاية API. نشر قواعد جدار حماية تطبيقات الويب لكشف حمولات JSON المتداخلة. راقب استهلاك موارد نقاط نهاية API للكشف عن الشذوذ.

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

5.1 5.2

🔵 SAMA CSF

CC-6.1 CC-6.2

🟡 ISO 27001:2022

A.12.6.1 A.14.2.1

🔗 References & Sources 5

🔗

https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18

product-cna@github.com

Release Notes Vendor Advisory

🔗

https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15

product-cna@github.com

Release Notes Vendor Advisory

🔗

https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9

product-cna@github.com

Release Notes Vendor Advisory

🔗

https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6

product-cna@github.com

Release Notes Vendor Advisory

🔗

https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2

product-cna@github.com

Release Notes Vendor Advisory

📦 Affected Products / CPE 5 entries

github:enterprise_server

📊 CVSS Score

7.5

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredN — None / Network

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityN — None / Network

IntegrityN — None / Network

AvailabilityH — High

📋 Quick Facts

Severity High

CVSS Score7.5

CWECWE-770

EPSS0.05%

Exploit No

Patch ✗ No

Published 2026-05-07

Source Feed nvd

🇸🇦 Saudi Risk Score

7.0

/ 10.0 — Saudi Risk

Priority: HIGH

🏷️ Tags

CWE-770

🏢 Vendor Advisories

🔗 https://docs.github.com/en/enterprise-server@3.16/ad... 🔗 https://docs.github.com/en/enterprise-server@3.17/ad... 🔗 https://docs.github.com/en/enterprise-server@3.18/ad... 🔗 https://docs.github.com/en/enterprise-server@3.19/ad... 🔗 https://docs.github.com/en/enterprise-server@3.20/ad...

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

CVE-2026-7541

Introduce Yourself

Sign In Required