Dashboard / CVE-2026-15996

CVE-2026-15996

MEDIUM
MEDIUM Priority: 0.05 BB Relevance: 73/100
Published: 2026-08-05 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: None
VC: None
VI: None
VA: High

Description

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing and authentication, any POST endpoint could be used to trigger the condition, which could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16.

Weakness Classification (1)

Affected Software (4)

VendorProductVersion
github enterprise_server < 3.17.16
github enterprise_server 3.18.0 – 3.18.10
github enterprise_server 3.19.0 – 3.19.7
github enterprise_server 3.20.0 – 3.20.3

References & Advisories (4)

Bug Bounty Relevance

73 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.6 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.77%
Raw Score 0.007660
Percentile 55.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00766
2026-10-28
0.00766

Intelligence Sources

nvd ref →

External Links