CVE-2026-15996 is a denial of service flaw (CVSS 7.5) in GitHub Enterprise Server. A crafted form-encoded POST request with deeply nested parameters can use excessive CPU and exhaust worker processes without authentication, making the instance unresponsive. Fixed in 3.20.3, 3.19.7, 3.18.10 and 3.17.16.
What's affected
- All GitHub Enterprise Server versions before 3.21, per the record.
- Fixed: 3.20.3, 3.19.7, 3.18.10 and 3.17.16.
- Any POST endpoint can be used, since parameters were parsed before routing and authentication.
Source conflict on severity: the record scores this 7.5 High (vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The GitHub 3.20.3 release notes I read label the issue Medium. Both labels appear here.
How to check if you're exposed
Check your appliance version in the management console, or from the administrative shell.
ghe-version
Match the output to the fixed versions for your release line. If you are on 3.17, the fix is 3.17.16, and for 3.18 it is 3.18.10. Because the flaw needs no account, exposure depends on who can send HTTP requests to the instance. An instance reachable from the internet is the most exposed.
What to do now
- Find your GitHub Enterprise Server version.
- Upgrade to the patch release for your line: 3.17.16, 3.18.10, 3.19.7 or 3.20.3, or move to 3.21.
- Limit network access to the instance to the users and networks that need it.
- Watch CPU and worker pool saturation on the appliance, which is how an attack would show up.
Why it matters
The record classes this as CWE-674 (Uncontrolled Recursion). Parsing deeply nested form parameters takes more and more work, and a small request can cost a lot of CPU. When parsing happens before routing and authentication, any endpoint that accepts a POST becomes a way to trigger it.
A source code host is a core business system, and an unresponsive instance stops builds, reviews and releases. The lesson for web applications is to cap parameter nesting at the edge. The record does not list the CVE as exploited, and it is not in the CISA KEV catalog.
Resource exhaustion shows up as slow responses before it shows up as an outage. Alert on worker pool saturation and request queue depth on the appliance, and keep a reverse proxy or firewall rule ready to restrict access if an attack is under way before you can patch.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need an account?
No. Parameters were parsed before authentication, per the record.
Which line gets which fix?
3.17.16, 3.18.10, 3.19.7 and 3.20.3. Versions at 3.21 are not in the affected range.
Sources
Last reviewed: 18 October 2026.
