CVE-2026-15996: GitHub Enterprise Server DoS Vulnerability

CVE-2026-15996 Overview

CVE-2026-15996 is a denial of service vulnerability in GitHub Enterprise Server. An unauthenticated attacker can send a crafted application/x-www-form-urlencoded HTTP POST request containing deeply nested parameters to trigger excessive CPU consumption. The malformed payload exhausts the pool of request-handling worker processes and renders the instance unresponsive.

Parameter parsing occurs before routing and authentication, so any POST endpoint is a viable trigger. The flaw affects all GitHub Enterprise Server versions prior to 3.21 and is patched in 3.20.3, 3.19.7, 3.18.10, and 3.17.16. The weakness is classified as [CWE-674] Uncontrolled Recursion.

Critical Impact
An unauthenticated network attacker can render a GitHub Enterprise Server instance unresponsive by sending a single crafted POST request to any endpoint.

Affected Products

GitHub Enterprise Server versions prior to 3.17.16
GitHub Enterprise Server 3.18.x prior to 3.18.10, and 3.19.x prior to 3.19.7
GitHub Enterprise Server 3.20.x prior to 3.20.3

Discovery Timeline

2026-08-05 - CVE-2026-15996 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-15996

Vulnerability Analysis

The vulnerability is an algorithmic complexity issue in the HTTP form parameter parser used by GitHub Enterprise Server. When the parser processes deeply nested parameter structures such as a[b][c][d]...=1, it performs recursive work whose cost grows sharply with nesting depth. A single request can therefore consume a disproportionate amount of CPU.

Because parsing runs before routing and authentication, no valid credentials or specific endpoint knowledge are required. Any POST route on the appliance can serve as the trigger. Repeated requests exhaust the worker process pool, blocking legitimate traffic and disrupting Git operations, code review, CI integrations, and administrative access.

Root Cause

The root cause is uncontrolled recursion [CWE-674] during form-encoded parameter deserialization. The parser did not enforce a bound on nesting depth or total parameter complexity. Attacker-controlled input directly drives recursion depth, converting a small request into a large amount of server-side work.

Attack Vector

Exploitation requires only network reachability to the GitHub Enterprise Server HTTP interface. The attacker crafts a POST request with Content-Type: application/x-www-form-urlencoded and a body containing deeply nested keys. The request is sent to any POST endpoint, including endpoints that would normally reject unauthenticated requests, because parameter parsing occurs before authorization checks. Sustained sending of these payloads keeps worker processes tied up and prevents the instance from serving legitimate traffic.

No verified public exploit code is available. Refer to the GitHub Enterprise Release Notes 3.20.3 for vendor details.

Detection Methods for CVE-2026-15996

Indicators of Compromise

Spikes in CPU utilization on GitHub Enterprise Server frontend and Unicorn/Puma worker processes without a corresponding increase in legitimate request volume.
HTTP POST requests with Content-Type: application/x-www-form-urlencoded containing unusually long keys with many nested brackets, for example a[b][c][d][e]....
Growing queues of pending requests and rising 502 or 504 responses from the load balancer fronting the appliance.

Detection Strategies

Inspect reverse proxy or WAF logs for POST bodies that exceed a normal parameter nesting depth threshold, such as more than 10 bracket pairs in a single key.
Correlate short bursts of POST requests from a single source IP with sudden worker saturation on the appliance.
Alert on unauthenticated POST requests to endpoints that normally see negligible anonymous traffic.

Monitoring Recommendations

Track worker process saturation, request queue depth, and per-request CPU time as first-class SRE metrics for the appliance.
Ship HTTP access logs and appliance system logs to a centralized analytics platform for baseline comparison and anomaly detection.
Set alerting thresholds on sustained POST request rates from single sources against pre-authentication endpoints.

How to Mitigate CVE-2026-15996

Immediate Actions Required

Upgrade GitHub Enterprise Server to 3.20.3, 3.19.7, 3.18.10, or 3.17.16, matching your current release track.
Restrict network exposure of the appliance to trusted networks or VPN ranges until patching is complete.
Place a WAF or reverse proxy in front of the appliance to reject form-encoded bodies with excessive parameter nesting.

Patch Information

GitHub has released fixed versions on all supported branches. Review the GitHub Enterprise Release Notes 3.20.3, GitHub Enterprise Release Notes 3.19.7, GitHub Enterprise Release Notes 3.18.10, and GitHub Enterprise Release Notes 3.17.16. Versions 3.21 and later are not affected.

Workarounds

Configure an upstream proxy or WAF rule to block POST requests whose body length or bracket-nesting depth exceeds a safe threshold.
Rate-limit unauthenticated POST requests at the load balancer to reduce the impact of repeated exploitation attempts.
Restrict access to the HTTPS interface using network ACLs so that only known corporate ranges can reach POST endpoints.

bash

# Example NGINX rule to drop overly nested form parameters
map $request_body $nested_form_abuse {
    default 0;
    "~\[[^\]]*\](\[[^\]]*\]){9,}" 1;
}

server {
    listen 443 ssl;
    server_name ghes.example.com;

    if ($nested_form_abuse) {
        return 400;
    }

    client_max_body_size 50m;
    proxy_pass https://ghes-backend;
}