A denial of service was discovered in GitHub Enterprise Server that permits an unauthenticated attacker to send crafted requests with deeply nested JSON payloads to an unauthenticated API endpoint. The endpoint parses user-controlled JSON without imposing limits on size or depth, which can cause excessive CPU and memory consumption and bring the service to a halt. The vulnerability is a classic example of uncontrolled resource consumption (CWE‑770).

The flaw affects all GitHub Enterprise Server releases prior to 3.21. It has been fixed in the release sequence 3.20.2, 3.19.6, 3.18.9, 3.17.15, and 3.16.18, covering versions 3.16, 3.17, 3.18, 3.19, and 3.20.

With a CVSS score of 6.3 the risk is elevated, though the EPSS score is not provided so the current exploit probability is unclear. The vulnerability is not listed in CISA’s KEV catalog, but any exposed GitHub Enterprise Server that has not been updated remains susceptible. Attackers can trigger the path simply by sending specially crafted JSON to the public API without authentication, so the threat is readily exploitable if the server is reachable. The impact is service disruption, which can lead to loss of availability for all users of the platform.