CVE-2026-15007: GitHub Enterprise Server DoS Vulnerability

CVE-2026-15007 Overview

CVE-2026-15007 is a denial of service vulnerability in GitHub Enterprise Server. An authenticated user can disrupt the service by supplying a repository release notes configuration file containing deeply nested YAML. The release notes generator parses the configuration file without enforcing a nesting depth limit. This causes excessive CPU and memory consumption that can render the instance unresponsive. The flaw is classified as [CWE-770] Allocation of Resources Without Limits or Throttling. GitHub received the report through its Bug Bounty program and patched the issue across supported release trains.

Critical Impact
An authenticated user can render a GitHub Enterprise Server instance unresponsive by uploading a repository release notes configuration file with deeply nested YAML, affecting availability for all users of the instance.

Affected Products

GitHub Enterprise Server versions prior to 3.17.18
GitHub Enterprise Server 3.18.x prior to 3.18.12, 3.19.x prior to 3.19.9, and 3.20.x prior to 3.20.5
GitHub Enterprise Server 3.21.x prior to 3.21.3

Discovery Timeline

2026-07-17 - CVE-2026-15007 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-15007

Vulnerability Analysis

The vulnerability resides in the release notes generation feature of GitHub Enterprise Server. Repositories can define a release notes configuration file in YAML format that instructs the platform how to categorize pull requests when producing release notes. When a release is generated, the server parses this configuration file. The parser accepts YAML documents without enforcing a maximum nesting depth. An authenticated user with permission to modify the configuration file can supply content that nests structures many levels deep. Parsing such input forces the YAML library to allocate large object graphs and traverse recursive structures. The resulting resource consumption starves the appliance of CPU and memory, degrading service for other tenants.

Root Cause

The root cause is missing input validation on the depth of YAML structures during configuration parsing. The parser trusts the document structure and continues descending into nested nodes indefinitely. Without a depth ceiling, small input files can expand into large in-memory representations. This is a classic uncontrolled resource consumption pattern captured by [CWE-770].

Attack Vector

Exploitation requires an authenticated account with write access to a repository on the affected GitHub Enterprise Server instance. The attacker commits a crafted release notes configuration file, typically at .github/release.yml, containing a deeply nested YAML document. Triggering a release note generation event causes the server to parse the file and consume resources until the instance becomes unresponsive. No user interaction from an administrator is required.

No verified public proof-of-concept code is available for CVE-2026-15007. Refer to the GitHub Enterprise Server release notes for each affected branch for authoritative technical details.

Detection Methods for CVE-2026-15007

Indicators of Compromise

Sudden spikes in CPU or memory utilization on GitHub Enterprise Server appliance nodes coinciding with release creation events.
Repository commits that add or modify .github/release.yml with unusually large size or deep indentation patterns.
Elevated latency or timeouts on GitHub Enterprise Server API and web UI requests during release note generation.

Detection Strategies

Inspect audit logs for repeated release creation events by a single user across one or more repositories.
Scan repository content for release configuration YAML files whose structural depth exceeds a reasonable threshold, such as more than 20 nested levels.
Correlate appliance-level performance degradation with git push events touching release configuration files.

Monitoring Recommendations

Enable and forward GitHub Enterprise Server audit log streams to a centralized log store for retrospective analysis.
Alert on sustained high resource utilization on appliance components responsible for release note generation.
Track repository activity by users who recently gained write access, focusing on modifications to workflow and configuration files.

How to Mitigate CVE-2026-15007

Immediate Actions Required

Upgrade GitHub Enterprise Server to a fixed release: 3.17.18, 3.18.12, 3.19.9, 3.20.5, or 3.21.3, or later.
Review recent commits to .github/release.yml files across repositories for suspicious deeply nested YAML content.
Restrict repository write access to trusted users while patching is in progress.

Patch Information

GitHub fixed CVE-2026-15007 in GitHub Enterprise Server versions 3.17.18, 3.18.12, 3.19.9, 3.20.5, and 3.21.3. The vulnerability affects all versions prior to 3.22. Refer to the official release notes for each branch: GitHub Enterprise Release Notes 3.17.18, GitHub Enterprise Release Notes 3.18.12, GitHub Enterprise Release Notes 3.19.9, GitHub Enterprise Release Notes 3.20.5, and GitHub Enterprise Release Notes 3.21.3.

Workarounds

Limit repository write permissions to trusted users until the appliance is upgraded to a fixed version.
Monitor and remove any .github/release.yml files that contain unusually deep YAML nesting.
Avoid generating release notes on repositories with untrusted configuration files until patching is complete.

bash

# Example: identify release configuration files with excessive nesting depth
# Run against a mirrored clone of each repository on the appliance
find . -path '*/.github/release.yml' -print0 | \
  xargs -0 -I{} awk '
    {
      match($0, /^ */);
      depth = RLENGTH / 2;
      if (depth > max) max = depth;
    }
    END { if (max > 20) print FILENAME ": max depth " max }
  ' {}