CVE-2026-15996: 
GitHub Enterprise Server vulnerability analysis and mitigation

CVE-2026-15996 is a denial of service (DoS) vulnerability in GitHub Enterprise Server (GHES) that allows an unauthenticated remote attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes, rendering the instance unresponsive. The vulnerability is triggered by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. It affects all versions of GHES prior to 3.21, specifically versions 3.17.0–3.17.15, 3.18.0–3.18.9, 3.19.0–3.19.6, and 3.20.0–3.20.2. It was published on August 5, 2026, and carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.6 (Medium) (Github Advisory, GHES 3.20 Release Notes).

The root cause is classified as CWE-674 (Uncontrolled Recursion): the server's HTTP request parameter parser processes deeply nested form-encoded parameters recursively without enforcing a depth or recursion limit, leading to unbounded CPU consumption (Github Advisory). Critically, parameter parsing occurs before request routing and authentication, meaning any POST endpoint on the server can be used to trigger the condition — no valid credentials or specific endpoint knowledge is required. The attack is network-accessible, requires low complexity, and is fully automatable, making it straightforward to weaponize at scale. The vulnerability maps to CAPEC-230 (Serialized Data with Nested Payloads) and CAPEC-231 (Oversized Serialized Data Payloads) (Github Advisory).

Successful exploitation results in a complete availability impact on the affected GHES instance: excessive CPU consumption exhausts the worker process pool, causing the instance to become unresponsive and denying service to all legitimate users. There is no confidentiality or integrity impact — the vulnerability is purely a DoS condition. For organizations relying on GHES as their central code collaboration and CI/CD platform, an unresponsive instance can disrupt software development workflows, block deployments, and prevent access to source code repositories (Github Advisory).

There is no public proof-of-concept exploit code known at this time, and no evidence of active in-the-wild exploitation has been reported (Github Advisory). The EPSS score is approximately 0.4% (37th percentile), indicating a relatively low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack is fully automatable and requires no authentication, meaning the barrier to exploitation is low for any attacker with network access to a vulnerable GHES instance.

1. Reconnaissance: Identify internet-facing or network-accessible GitHub Enterprise Server instances using tools like Shodan, Censys, or internal network scanning. Confirm the version is prior to 3.17.16, 3.18.10, 3.19.7, or 3.20.3.
2. Craft malicious payload: Construct a form-encoded HTTP POST request body containing deeply nested parameters (e.g., a[b][c][d][e][f]...[z]=value repeated to extreme depth) designed to trigger recursive parsing.
3. Target any POST endpoint: Since parameter parsing occurs before routing and authentication, select any accessible POST endpoint on the GHES instance (e.g., login page, API endpoints, webhook receivers).
4. Send the request: Transmit the crafted POST request to the target endpoint using tools such as curl, python-requests, or a custom script. No authentication headers are required.
5. Repeat to exhaust resources: Send multiple such requests in rapid succession (or in parallel) to saturate CPU resources and deplete the worker process pool, causing the instance to become unresponsive to all subsequent requests (Github Advisory).

• Network: Unusual volume of HTTP POST requests from one or more source IPs targeting any GHES endpoint, particularly with abnormally large or deeply structured request bodies; connections that do not follow normal user-agent patterns.
• Logs: GHES web server access logs showing repeated POST requests with large Content-Length values or form-encoded bodies containing deeply nested bracket notation parameters (e.g., param[a][b][c]...); application logs showing worker process timeouts or exhaustion errors.
• System Metrics: Sudden and sustained spike in CPU utilization on the GHES appliance without a corresponding increase in legitimate user activity; worker process pool saturation visible in monitoring dashboards; instance health checks failing or returning timeouts.

GitHub has released patched versions addressing this vulnerability: 3.17.16, 3.18.10, 3.19.7, 3.20.3, and all versions 3.21 and later. Administrators should upgrade to the appropriate patched release as the primary remediation (GHES 3.17 Release Notes, GHES 3.18 Release Notes, GHES 3.19 Release Notes, GHES 3.20 Release Notes). As a temporary workaround where immediate upgrade is not possible, implement network-level controls such as rate limiting or WAF rules to restrict or throttle POST requests with abnormally deep parameter nesting, and consider restricting access to the GHES instance to trusted IP ranges.