GitHub Enterprise Server CVE-2026-7541

The vulnerability requires: (1) network-accessible GitHub Enterprise Server running a version prior to 3.21 (specifically 3.16.0-3.20.1); (2) an unauthenticated API endpoint enabled and accepting JSON POST requests (default configuration); (3) no request size or depth limits enforced by the application or reverse proxy in front of it. No user interaction, authentication, or non-default configuration is needed for exploitation. Limitations: if the instance is network-isolated or the vulnerable API endpoint is behind authentication, the attack surface is eliminated. If a reverse proxy or WAF enforces payload size limits or request rate limiting, exploitation difficulty increases significantly.

CVSS 6.3 with AV:N (network-accessible), AC:L (low complexity), and PR:N (unauthenticated) indicates a moderately severe issue with low barrier to exploitation. The attack timing parameter (AT:P) suggests some additional temporal constraint that reduces exploitability. The vector reports high availability impact (VA:H) but no confidentiality or integrity impact, confirming a DoS-only exposure. No KEV (CISA Known Exploited Vulnerabilities) status, POC availability, or EPSS score provided; however, the combination of network accessibility, no authentication requirement, and low complexity suggests realistic operational risk. GitHub's public disclosure via documented release notes and Bug Bounty program reporting indicate vendor transparency. The primary limiting factor is that exploitation requires identifying and accessing the specific unauthenticated API endpoint; defenders should prioritize patching over extensive behavioral analysis given the straightforward attack surface (deeply nested JSON).

An attacker discovers a public GitHub Enterprise Server instance and crafts a JSON payload with deeply nested objects (e.g., {'a': {'b': {'c': ... }}} repeated hundreds of levels deep). The attacker sends this payload via HTTP POST to an unauthenticated API endpoint without authentication headers. The server's JSON parser attempts to deserialize the nested structure recursively, consuming memory and CPU until the process becomes unresponsive, making the service unavailable to legitimate users.