CVE-2026-15996: Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing and authentication, any POST endpoint could be used to trigger the condition, which could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.20.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.19.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.18.10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.17.16
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15996?
The severity of CVE-2026-15996 is classified as a risk score of 66.
How do I fix CVE-2026-15996?
To remediate CVE-2026-15996, update your GitHub Enterprise Server to the latest patched version.
What kind of attack does CVE-2026-15996 facilitate?
CVE-2026-15996 facilitates a denial of service attack through excessive CPU consumption from crafted HTTP POST requests.
Can CVE-2026-15996 be exploited by authenticated users?
No, CVE-2026-15996 can be exploited by unauthenticated users.
In which software is CVE-2026-15996 found?
CVE-2026-15996 is found in the GitHub Enterprise Server.