CVE-2026-15007

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to cause service disruption by supplying a repository release notes configuration file containing deeply nested YAML. When release notes were generated, the configuration file was parsed without a nesting depth limit, causing excessive resource consumption that could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.18, 3.18.12, 3.19.9, 3.20.5, and 3.21.3. This vulnerability was reported via the GitHub Bug Bounty program.

CVSS

No CVSS.

References

Link	Resource
https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.18
https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.12
https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.9
https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.5
https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.3

Configurations

No configuration.

History

17 Jul 2026, 16:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-17 16:17

Updated : 2026-07-17 18:11

NVD link : CVE-2026-15007

Mitre link : CVE-2026-15007

CVE.ORG link : CVE-2026-15007

JSON object : View

Products Affected

No product.

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-15007", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15007", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T16:35:53.532624Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "product-cna@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "product-cna@github.com", "affectedData": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "changes": [{"at": "3.17.18", "status": "unaffected"}], "version": "3.17.0", "versionType": "semver", "lessThanOrEqual": "3.17.17"}, {"status": "affected", "changes": [{"at": "3.18.12", "status": "unaffected"}], "version": "3.18.0", "versionType": "semver", "lessThanOrEqual": "3.18.11"}, {"status": "affected", "changes": [{"at": "3.19.9", "status": "unaffected"}], "version": "3.19.0", "versionType": "semver", "lessThanOrEqual": "3.19.8"}, {"status": "affected", "changes": [{"at": "3.20.5", "status": "unaffected"}], "version": "3.20.0", "versionType": "semver", "lessThanOrEqual": "3.20.4"}, {"status": "affected", "changes": [{"at": "3.21.3", "status": "unaffected"}], "version": "3.21.0", "versionType": "semver", "lessThanOrEqual": "3.21.2"}], "defaultStatus": "affected"}]}], "published": "2026-07-17T16:17:13.743", "references": [{"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.18", "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.12", "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.9", "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.5", "source": "product-cna@github.com"}, {"url": "https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.3", "source": "product-cna@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "product-cna@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to cause service disruption by supplying a repository release notes configuration file containing deeply nested YAML. When release notes were generated, the configuration file was parsed without a nesting depth limit, causing excessive resource consumption that could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.18, 3.18.12, 3.19.9, 3.20.5, and 3.21.3. This vulnerability was reported via the GitHub Bug Bounty program."}], "lastModified": "2026-07-17T18:11:59.263", "sourceIdentifier": "product-cna@github.com"}