GitHub Enterprise Server CVE-2026-15996

No special conditions are required beyond network connectivity to the GitHub Enterprise Server instance. Because parameter parsing occurs before routing and authentication, no valid account, session token, or knowledge of specific endpoints is needed - any POST endpoint, including publicly accessible ones such as the login form, suffices. Exploitation is not limited to any specific configuration, feature flag, or non-default setting. What limits exploitation is network-level access: instances isolated behind a VPN or restricted to internal networks reduce the attacker pool to those with internal access. Additionally, the attack causes availability disruption only (no data exfiltration or integrity impact), and the effect is transient - the instance can recover once the malicious request volume stops and worker processes are recycled.

The CVSS 4.0 base score of 6.6 reflects a network-accessible (AV:N), low-complexity (AC:L), no-privileges-required (PR:N), no-user-interaction (UI:N) attack with high availability impact but zero confidentiality or integrity impact (VC:N/VI:N/VA:H). The E:U (unexploited) temporal modifier accurately signals no known active exploitation at time of scoring, and the vulnerability is absent from the CISA KEV catalog. No EPSS data was provided; however, given that the attack requires only a single unauthenticated HTTP request to any POST endpoint and completely disables the instance, real-world risk is materially higher than the base score suggests for organizations with internet-exposed GHES instances or adversaries with internal network access. The lack of authentication or configuration prerequisites means any network-reachable attacker can attempt this trivially, making patch urgency high for exposed instances despite the absence of confirmed exploitation.

An unauthenticated attacker with network access to the GitHub Enterprise Server instance sends a single HTTP POST request to any endpoint (such as the login page or a public API route) with a form-encoded body containing parameters nested to an extreme depth, such as a[b][c][d]...[z]=1 repeated thousands of levels. The server's body parser recursively descends into the structure before any routing or authentication logic executes, consuming CPU until the process is blocked or killed, and repeating this at a modest request rate quickly saturates all available worker processes, rendering the instance unable to service legitimate requests.