CVE-2024-5795: Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed resource exhaustion
A Denial of Service vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause unbounded resource exhaustion by sending a large payload to the Git server. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in version 3.13.1, 3.12.6, 3.11.12, 3.10.14, and 3.9.17. This vulnerability was reported via the GitHub Bug Bounty program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.13.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.11.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.10.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.9.17
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5795?
CVE-2024-5795 has been classified as a Denial of Service vulnerability.
How do I fix CVE-2024-5795?
To fix CVE-2024-5795, upgrade to GitHub Enterprise Server version 3.14 or later.
Which versions are affected by CVE-2024-5795?
CVE-2024-5795 affects all versions of GitHub Enterprise Server prior to 3.14.
What type of attack does CVE-2024-5795 allow?
CVE-2024-5795 allows attackers to cause unbounded resource exhaustion by sending large payloads.
Is there a workaround for CVE-2024-5795?
There are no known workarounds for CVE-2024-5795; upgrading is the recommended solution.