Denial of Service Vulnerability in GitHub Enterprise Server

CVE-2026-15996

What is CVE-2026-15996?

A denial of service vulnerability has been identified in GitHub Enterprise Server, allowing unauthenticated attackers to trigger excessive CPU usage. By exploiting a crafted form-encoded HTTP POST request with deeply nested parameters, attackers can exhaust the pool of request-handling worker processes. This vulnerability affects all versions of GitHub Enterprise Server prior to 3.21 and can render the instance unresponsive due to improper request parameter parsing prior to routing and authentication. The flaw was addressed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16.

References