CVE-2026-15996

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15996", "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "state": "PUBLISHED", "assignerShortName": "GitHub_P", "dateReserved": "2026-07-16T21:29:33.097Z", "datePublished": "2026-08-05T20:12:57.955Z", "dateUpdated": "2026-08-06T13:48:59.999Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "shortName": "GitHub_P", "dateUpdated": "2026-08-05T20:12:57.955Z"}, "title": "Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "affected": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "version": "3.17.0", "lessThanOrEqual": "3.17.15", "changes": [{"at": "3.17.16", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.18.0", "lessThanOrEqual": "3.18.9", "changes": [{"at": "3.18.10", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.19.0", "lessThanOrEqual": "3.19.6", "changes": [{"at": "3.19.7", "status": "unaffected"}], "versionType": "semver"}, {"status": "affected", "version": "3.20.0", "lessThanOrEqual": "3.20.2", "changes": [{"at": "3.20.3", "status": "unaffected"}], "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing and authentication, any POST endpoint could be used to trigger the condition, which could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing and authentication, any POST endpoint could be used to trigger the condition, which could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16.<br><br>"}]}], "references": [{"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.16", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.10", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.7", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.3", "tags": ["release-notes"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.6, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T13:48:48.535295Z", "id": "CVE-2026-15996", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T13:48:59.999Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Denial of service vulnerability in GitHub Enterprise Server allowed unauthenticated service disruption via deeply nested request parameters", "source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "GitHub", "product": "Enterprise Server", "versions": [{"status": "affected", "changes": [{"at": "3.17.16", "status": "unaffected"}], "version": "3.17.0", "versionType": "semver", "lessThanOrEqual": "3.17.15"}, {"status": "affected", "changes": [{"at": "3.18.10", "status": "unaffected"}], "version": "3.18.0", "versionType": "semver", "lessThanOrEqual": "3.18.9"}, {"status": "affected", "changes": [{"at": "3.19.7", "status": "unaffected"}], "version": "3.19.0", "versionType": "semver", "lessThanOrEqual": "3.19.6"}, {"status": "affected", "changes": [{"at": "3.20.3", "status": "unaffected"}], "version": "3.20.0", "versionType": "semver", "lessThanOrEqual": "3.20.2"}], "defaultStatus": "affected"}], "references": [{"url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.16", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.10", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.7", "tags": ["release-notes"]}, {"url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.3", "tags": ["release-notes"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing and authentication, any POST endpoint could be used to trigger the condition, which could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16.", "supportingMedia": [{"type": "text/html", "value": "A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing and authentication, any POST endpoint could be used to trigger the condition, which could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16.<br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "shortName": "GitHub_P", "dateUpdated": "2026-08-05T20:12:57.955Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15996", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T13:48:48.535295Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-08-06T13:48:55.682Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-15996", "state": "PUBLISHED", "dateUpdated": "2026-08-05T20:12:57.955Z", "dateReserved": "2026-07-16T21:29:33.097Z", "assignerOrgId": "82327ea3-741d-41e4-88f8-2cf9e791e760", "datePublished": "2026-08-05T20:12:57.955Z", "assignerShortName": "GitHub_P"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Enterprise Server", "vendor": "GitHub", "versions": [{"changes": [{"at": "3.17.16", "status": "unaffected"}], "lessThanOrEqual": "3.17.15", "status": "affected", "version": "3.17.0", "versionType": "semver"}, {"changes": [{"at": "3.18.10", "status": "unaffected"}], "lessThanOrEqual": "3.18.9", "status": "affected", "version": "3.18.0", "versionType": "semver"}, {"changes": [{"at": "3.19.7", "status": "unaffected"}], "lessThanOrEqual": "3.19.6", "status": "affected", "version": "3.19.0", "versionType": "semver"}, {"changes": [{"at": "3.20.3", "status": "unaffected"}], "lessThanOrEqual": "3.20.2", "status": "affected", "version": "3.20.0", "versionType": "semver"}]}], "source": "product-cna@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "42CD4A0C-A4D0-4C5E-B971-11B3AD5F9D1E", "versionEndExcluding": "3.17.16", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "B3D5BD25-0F18-4915-9399-D42302247396", "versionEndExcluding": "3.18.10", "versionStartIncluding": "3.18.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "4FF939CE-B42A-4091-ACF0-AF80FFBFDC25", "versionEndExcluding": "3.19.7", "versionStartIncluding": "3.19.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "BA3298CD-3841-491D-8056-7AC03FC6473F", "versionEndExcluding": "3.20.3", "versionStartIncluding": "3.20.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing and authentication, any POST endpoint could be used to trigger the condition, which could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16."}, {"lang": "es", "value": "Una vulnerabilidad de denegaci\u00f3n de servicio fue identificada en GitHub Enterprise Server que permit\u00eda a un atacante no autenticado causar un consumo excesivo de CPU y agotar el grupo de procesos de trabajo que manejan las solicitudes enviando una solicitud HTTP POST codificada en formulario manipulada que conten\u00eda par\u00e1metros profundamente anidados. Debido a que los par\u00e1metros de la solicitud se analizaban antes del enrutamiento y la autenticaci\u00f3n, cualquier endpoint POST pod\u00eda usarse para desencadenar la condici\u00f3n, lo que pod\u00eda dejar la instancia sin respuesta. Esta vulnerabilidad afectaba a todas las versiones de GitHub Enterprise Server anteriores a la 3.21 y fue corregida en las versiones 3.20.3, 3.19.7, 3.18.10 y 3.17.16."}], "id": "CVE-2026-15996", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "product-cna@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15996", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-06T13:48:48.535295Z", "version": "2.0.3"}}]}, "published": "2026-08-05T21:16:57.250", "references": [{"source": "product-cna@github.com", "tags": ["Product", "Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.17/admin/release-notes#3.17.16"}, {"source": "product-cna@github.com", "tags": ["Product", "Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.18/admin/release-notes#3.18.10"}, {"source": "product-cna@github.com", "tags": ["Product", "Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.7"}, {"source": "product-cna@github.com", "tags": ["Product", "Release Notes"], "url": "https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.3"}], "sourceIdentifier": "product-cna@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "product-cna@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.17.0,3.17.15]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[3.17.16,3.18.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.18.0,3.18.9]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[3.18.10,3.19.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.19.0,3.19.6]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[3.19.7,3.20.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.20.0,3.20.2]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[3.20.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Enterprise Server", "source": "cna", "vendor": "GitHub"}, "product": "enterprise_server", "vendor": "github"}], "created": "2026-08-05T21:30:16.208549+00:00", "updated": "2026-08-05T21:30:16.325496+00:00", "vendors": ["github", "github$PRODUCT$enterprise_server"]}