GitHub Enterprise Server CVE-2026-7541

Q: What is the CVSS score of CVE-2026-7541?

CVE-2026-7541 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-28462 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-05-07 GitHub_P

GHSA-3738-jvgh-jh3h

Denial Of Service Enterprise Server

6.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 00:15 vuln.today

CVSS changed

May 07, 2026 - 22:22 NVD

6.3 (MEDIUM)

CVE Published

May 07, 2026 - 21:18 nvd

UNKNOWN (no severity yet)

CVE Published

May 07, 2026 - 21:18 nvd

MEDIUM 6.3

DescriptionGitHub Advisory

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parsed user-controlled JSON request bodies without size or depth limits, causing excessive CPU and memory consumption. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18. This vulnerability was reported via the GitHub Bug Bounty program.

AnalysisAI

Denial of service in GitHub Enterprise Server allows unauthenticated remote attackers to disrupt service by sending deeply nested JSON payloads to an unprotected API endpoint, causing excessive CPU and memory consumption. Affected versions prior to 3.21 (specifically 3.16.0-3.20.1) lack request size and depth validation. Vendor-released patches available for all affected branches: 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18.

Technical ContextAI

The vulnerability exists in GitHub Enterprise Server's JSON parser used by an unauthenticated API endpoint. The root cause is improper resource management (CWE-770) - the endpoint processes user-supplied JSON request bodies without enforcing limits on payload size or nesting depth. When an attacker submits a JSON structure with excessive nesting levels, the recursive parser consumes unbounded CPU and memory, triggering denial of service. This affects all versions of GitHub Enterprise Server from 3.16.0 through 3.20.1 (CPE: cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*).

RemediationAI

Upgrade GitHub Enterprise Server immediately to patched versions: 3.20.2 or later (preferred), or 3.19.6, 3.18.9, 3.17.15, or 3.16.18 if running older branches. Each version's release notes are available at https://docs.github.com/en/enterprise-server@[VERSION]/admin/release-notes. If immediate upgrade is not feasible, implement network-level mitigation: restrict access to the vulnerable unauthenticated API endpoint by disabling or gating it at the load balancer or reverse proxy, block requests with excessively nested JSON (depth > 50 levels), or implement request size limits (e.g., max 1 MB payload). These controls have trade-offs: gating the API may break legitimate automation; aggressive depth limits may reject valid payloads in rare cases. Upgrade remains the definitive fix.