A denial‑of‑service flaw exists in GitHub Enterprise Server that enables an authenticated user to cause a service outage by submitting a repository release‑notes configuration file containing extremely nested YAML. When the system generates release notes, the YAML parser processes the file without imposing a nesting depth limit, resulting in excessive allocation of CPU and memory resources that can make the instance unresponsive. This weakness is a resource‑exhaustion issue identified as CWE-770 and affects only availability.

GitHub Enterprise Server versions earlier than 3.22 are vulnerable. The vulnerability was fixed in releases 3.17.18, 3.18.12, 3.19.9, 3.20.5, and 3.21.3, and all versions 3.22 and newer contain the patch.

The CVSS base score of 5.7 indicates moderate severity, while the EPSS score of less than 1 percent reflects a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers must have authenticated access to a repository where they can modify release‑note YAML; based on the description it is inferred that a repository owner or collaborator could trigger the exploit by creating a deeply nested YAML document. Once triggered, the instance may experience high CPU or memory consumption, leading to service degradation or downtime.