CVE-2026-15996: CWE-674 Uncontrolled Recursion in GitHub Enterprise Server
CVE-2026-15996 is a denial of service vulnerability in GitHub Enterprise Server that allows unauthenticated attackers to cause excessive CPU usage and exhaust request-handling workers by sending crafted HTTP POST requests with deeply nested parameters. This affects all versions prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16.
AI Analysis
Technical Summary
This vulnerability involves uncontrolled recursion in the parameter parsing logic of GitHub Enterprise Server. Because parameters are parsed before routing and authentication, any POST endpoint can be exploited by sending a specially crafted form-encoded HTTP POST request containing deeply nested parameters. This leads to excessive CPU consumption and exhaustion of the worker process pool, potentially rendering the server unresponsive. The issue affects all versions prior to 3.21 and was addressed in patch releases 3.20.3, 3.19.7, 3.18.10, and 3.17.16.
Potential Impact
An unauthenticated attacker can cause a denial of service by overwhelming the server's CPU and exhausting worker processes, making the GitHub Enterprise Server instance unresponsive. This impacts availability but does not involve authentication bypass or data compromise according to the provided information.
Mitigation Recommendations
Upgrade GitHub Enterprise Server to one of the fixed versions: 3.20.3, 3.19.7, 3.18.10, or 3.17.16. These versions contain the official fix for this vulnerability. Patch status is confirmed by the vendor advisory information embedded in the description.
CVE-2026-15996: CWE-674 Uncontrolled Recursion in GitHub Enterprise Server
Description
CVE-2026-15996 is a denial of service vulnerability in GitHub Enterprise Server that allows unauthenticated attackers to cause excessive CPU usage and exhaust request-handling workers by sending crafted HTTP POST requests with deeply nested parameters. This affects all versions prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16.
CVSS v4.0
Score 6.6medium
Affected software
GitHub
Enterprise Server
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves uncontrolled recursion in the parameter parsing logic of GitHub Enterprise Server. Because parameters are parsed before routing and authentication, any POST endpoint can be exploited by sending a specially crafted form-encoded HTTP POST request containing deeply nested parameters. This leads to excessive CPU consumption and exhaustion of the worker process pool, potentially rendering the server unresponsive. The issue affects all versions prior to 3.21 and was addressed in patch releases 3.20.3, 3.19.7, 3.18.10, and 3.17.16.
Potential Impact
An unauthenticated attacker can cause a denial of service by overwhelming the server's CPU and exhausting worker processes, making the GitHub Enterprise Server instance unresponsive. This impacts availability but does not involve authentication bypass or data compromise according to the provided information.
Mitigation Recommendations
Upgrade GitHub Enterprise Server to one of the fixed versions: 3.20.3, 3.19.7, 3.18.10, or 3.17.16. These versions contain the official fix for this vulnerability. Patch status is confirmed by the vendor advisory information embedded in the description.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_P
- Date Reserved
- 2026-07-16T21:29:33.097Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a73a38dbf8831d53973c56c
Added to database: 08/05/2026, 20:56:45 UTC
Last enriched: 08/13/2026, 17:27:32 UTC
Last updated: 09/18/2026, 10:01:29 UTC
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.