CVE-2026-7541

{"id": "CVE-2026-7541", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7541", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-08T13:44:37.884506Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "product-cna@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "product-cna@github.com", "affectedData": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "changes": [{"at": "3.16.18", "status": "unaffected"}], "version": "3.16.0", "versionType": "semver", "lessThanOrEqual": "3.16.17"}, {"status": "affected", "changes": [{"at": "3.17.15", "status": "unaffected"}], "version": "3.17.0", "versionType": "semver", "lessThanOrEqual": "3.17.14"}, {"status": "affected", "changes": [{"at": "3.18.9", "status": "unaffected"}], "version": "3.18.0", "versionType": "semver", "lessThanOrEqual": "3.18.8"}, {"status": "affected", "changes": [{"at": "3.19.6", "status": "unaffected"}], "version": "3.19.0", "versionType": "semver", "lessThanOrEqual": "3.19.5"}, {"status": "affected", "changes": [{"at": "3.20.2", "status": "unaffected"}], "version": "3.20.0", "versionType": "semver", "lessThanOrEqual": "3.20.1"}], "defaultStatus": "affected"}]}], "published": "2026-05-07T22:16:36.917", "references": [{"url": "https://docs.github.com/en/enterprise-server@3.16/admin/release-notes#3.16.18", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.15", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.9", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.6", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.2", "tags": ["Release Notes", "Vendor Advisory"], "source": "product-cna@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "product-cna@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause service disruption by sending crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parsed user-controlled JSON request bodies without size or depth limits, causing excessive CPU and memory consumption. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18. This vulnerability was reported via the GitHub Bug Bounty program."}, {"lang": "es", "value": "Una vulnerabilidad de denegaci\u00f3n de servicio fue identificada en GitHub Enterprise Server que permit\u00eda a un atacante no autenticado causar una interrupci\u00f3n del servicio enviando solicitudes manipuladas con cargas \u00fatiles JSON profundamente anidadas a un endpoint de API no autenticado. El endpoint analizaba cuerpos de solicitud JSON controlados por el usuario sin l\u00edmites de tama\u00f1o o profundidad, causando un consumo excesivo de CPU y memoria. Esta vulnerabilidad afect\u00f3 a todas las versiones de GitHub Enterprise Server anteriores a la 3.21 y fue corregida en las versiones 3.20.2, 3.19.6, 3.18.9, 3.17.15 y 3.16.18. Esta vulnerabilidad fue reportada a trav\u00e9s del programa GitHub Bug Bounty."}], "lastModified": "2026-10-26T20:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30904527-43B5-453A-A669-7845C2643965", "versionEndExcluding": "3.16.18"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D594E173-80DE-4EC9-9E6C-8C78A80D1402", "versionEndExcluding": "3.17.15", "versionStartIncluding": "3.17.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2501EC91-4CD0-49F5-B76A-558EB5A5946C", "versionEndExcluding": "3.18.9", "versionStartIncluding": "3.18.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2D6ABE3-EF68-4DDC-9846-9A891C859477", "versionEndExcluding": "3.19.6", "versionStartIncluding": "3.19.0"}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC8A09E8-5FFE-43F1-BC1A-14A298264D80", "versionEndExcluding": "3.20.2", "versionStartIncluding": "3.20.0"}], "operator": "OR"}]}], "sourceIdentifier": "product-cna@github.com"}