Executive brief
A denial of service vulnerability was identified in GitHub Enterprise Server, a platform used by organizations to host and manage software development. An unauthenticated attacker could disrupt the service by sending specially crafted requests to a public API endpoint, causing the server to consume excessive processor and memory resources. This could lead to significant downtime and prevent legitimate users from accessing their code repositories and development tools.
Technical details
A denial of service vulnerability exists in GitHub Enterprise Server due to improper resource management (CWE-770) in an unauthenticated API endpoint (specifically the stats endpoint). The application parses user-controlled JSON request bodies without enforcing maximum size or recursion depth limits. An unauthenticated remote attacker can exploit this by sending crafted requests with deeply nested JSON payloads, leading to excessive CPU and memory consumption. This vulnerability affects all versions prior to 3.21 and has been addressed by implementing maximum size and depth validation in the affected endpoint.
Affected products
- GitHub Enterprise Server < 3.21
Timeline
- 2026-05-07: disclosed
- 2026-05-07: patched: Fixed in versions 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18
- 2026-05-07: advisory
References
- https://docs.github.com/en/enterprise-server@3.16/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.17/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.18/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.19/admin/release-notes
- https://docs.github.com/en/enterprise-server@3.20/admin/release-notes