Skip to content

GitHub · weakness class

Denial of Service

11 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Every one of the 11 is a mark on the map. Named now: 1 to 11, most at risk first.

  1. Uncontrolled Resource Consumption in cmark-gfmCVE-2022-39209github · CVSS 7.5 · 2.3% likely

    CWE-400

  2. cmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of serviceCVE-2023-22486github · CVSS 3.5 · 1.1% likely

    CWE-407

  3. cmark-gfm Quadratic complexity bugs may lead to a denial of serviceCVE-2023-22483github · CVSS 3.5 · 1.1% likely

    CWE-400

  4. Quadratic complexity may lead to a denial of service in cmark-gfmCVE-2023-24824github · CVSS 5.3 · 1.0% likely

    CWE-407

  5. Quadratic complexity may lead to a denial of service in cmark-gfmCVE-2023-26485github · CVSS 5.3 · 1.0% likely

    CWE-407

  6. Inefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of serviceCVE-2023-22484github · CVSS 3.5 · 1.0% likely

    CWE-407

  7. Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parametersCVE-2026-15996GitHub · CVSS 6.6 · 0.8% likely

    CWE-674

  8. Quadratic complexity bugs may lead to a denial of serviceCVE-2023-37463github · CVSS 6.4 · 0.7% likely

    CWE-400

  9. Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via deeply nested YAML in release notes configurationCVE-2026-15007GitHub · CVSS 5.7 · 0.6% likely

    CWE-770

  10. Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed resource exhaustionCVE-2024-5795GitHub · CVSS 7.7 · 0.6% likely

    CWE-400

  11. Denial of service vulnerability in GitHub Enterprise Server allowed service disruption via unauthenticated API endpointCVE-2026-7541GitHub · CVSS 6.3 · 0.4% likely

    CWE-770

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

Updated AboutDevelopersSign in