Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-15996: GitHub Enterprise Server CPU Consumption Denial of Service

CVE-2026-15996 · published 3 months ago

Summary

An attacker could send a specially crafted request to GitHub Enterprise Server, causing it to consume excessive CPU resources and become unresponsive. This affected all versions of GitHub Enterprise Server before 3.21, but has been fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16. Users should update to a patched version to prevent this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
github	enterprise_server	< 3.17.16 >= 3.18.0, < 3.18.10 >= 3.19.0, < 3.19.7 >= 3.20.0, < 3.20.3 `cpe:2.3:a:github:enterprise_server::::::::`

Original advisory text

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing and authentication, any POST endpoint could be used to trigger the condition, which could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16.

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

6.6 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-674Uncontrolled Recursion

Timeline

Published5 Aug 2026

Updated4 Nov 2026

First seen5 Aug 2026

Sources

CVE-2026-15996 · NVD

Track software like this

Free during beta