CVE-2026-15996: github enterprise_server Uncontrolled Recursion

Vulnerability summary

CVE-2026-15996 is a high (CVSS 7.5) Uncontrolled Recursion vulnerability in github enterprise_server. EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 54.6% of scored vulnerabilities.

Timeline

1. 05-08-2026
   PublishedVulnerability first disclosed.
2. 06-08-2026
   Last modifiedVulnerability information updated.

Description

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing and authentication, any POST endpoint could be used to trigger the condition, which could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16.

• CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.