CVE-2026-15996

Received Received - Intake

Denial of Service in GitHub Enterprise Server

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: GitHub, Inc. (Products Only)

Description

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing and authentication, any POST endpoint could be used to trigger the condition, which could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-05

Generated

2026-08-06

AI Q&A

2026-08-06

EPSS Evaluated

N/A

NVD

CVE-2026-15996

EUVD

EUVD-2026-53611

Affected Vendors & Products

Vendor	Product	Version / Range
github	enterprise_server	to 3.17.16 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This is a denial of service vulnerability in GitHub Enterprise Server where an unauthenticated attacker sends a crafted HTTP POST request with deeply nested parameters. This causes excessive CPU usage and exhausts worker processes, making the server unresponsive. It affects all versions before 3.21 and was fixed in 3.20.3, 3.19.7, 3.18.10, and 3.17.16.

Detection Guidance

Monitor for excessive CPU usage or unresponsive instances after receiving POST requests with deeply nested parameters. Check GitHub Enterprise Server logs for unusual request patterns or errors related to worker process exhaustion.

Impact Analysis

An attacker could exploit this to crash your GitHub Enterprise Server instance, causing downtime and preventing users from accessing repositories or services. This disrupts development workflows and may lead to data unavailability.

Mitigation Strategies

Upgrade GitHub Enterprise Server to a fixed version (3.20.3, 3.19.7, 3.18.10, or 3.17.16 or later). If immediate upgrade is not possible, restrict access to POST endpoints or implement rate limiting to prevent abuse.

Hi! I’m here to help you understand CVE-2026-15996. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70