CVE-2026-15996
published 2026-08-05CVE-2026-15996: A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and…
PriorityP349high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.44%
37.4th percentile
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing and authentication, any POST endpoint could be used to trigger the condition, which could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github | enterprise_server | < 3.17.16 | 3.17.16 |
| github | enterprise_server | 3.17.0 – 3.17.15 | — |
| github | enterprise_server | >= 3.18.0 < 3.18.10 | 3.18.10 |
| github | enterprise_server | 3.18.0 – 3.18.9 | — |
| github | enterprise_server | >= 3.19.0 < 3.19.7 | 3.19.7 |
| github | enterprise_server | 3.19.0 – 3.19.6 | — |
| github | enterprise_server | >= 3.20.0 < 3.20.3 | 3.20.3 |
| github | enterprise_server | 3.20.0 – 3.20.2 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.06.6MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
GitHub Enterprise Server up to 3.17.15/3.18.9/3.19.6/3.20.2 resource consumption
vuldb·2026-08-05·CVSS 6.6
CVE-2026-15996 [MEDIUM] GitHub Enterprise Server up to 3.17.15/3.18.9/3.19.6/3.20.2 resource consumption
A vulnerability identified as problematic has been detected in GitHub Enterprise Server up to 3.17.15/3.18.9/3.19.6/3.20.2. Affected by this issue is some unknown functionality. Performing a manipulation results in resource consumption.
This vulnerability is cataloged as CVE-2026-15996. It is possible to initiate the attack remotely. There is no exploit available.
You should upgrade the affected component.
GHSA
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker
ghsa_unreviewed·2026-08-05
CVE-2026-15996 [MEDIUM] CWE-674 A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing and authentication, any POST endpoint could be used to trigger the condition, which could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-05
Published