EUVD-2026-53611
GHSA-3x3p-rpwc-h9wf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-reachable GHES POST endpoint
-
DeliveryCraft form-encoded body with extreme parameter nesting depth
-
ExploitSend unauthenticated HTTP POST request
-
ExecutionServer recursively parses nested parameters pre-authentication
-
PersistCPU exhaustion saturates worker process pool
-
ImpactInstance becomes unresponsive to all requests
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Recursion depth limits
|
| Exploitation Conditions | No special conditions are required beyond network connectivity to the GitHub Enterprise Server instance. Because parameter parsing occurs before routing and authentication, no valid account, session token, or knowledge of specific endpoints is needed - any POST endpoint, including publicly accessible ones such as the login form, suffices. Exploitation is not limited to any specific configuration, feature flag, or non-default setting. What limits exploitation is network-level access: instances isolated behind a VPN or restricted to internal networks reduce the attacker pool to those with internal access. Additionally, the attack causes availability disruption only (no data exfiltration or integrity impact), and the effect is transient - the instance can recover once the malicious request volume stops and worker processes are recycled. |
| Impact | The CVSS 4.0 base score of 6.6 reflects a network-accessible (AV:N), low-complexity (AC:L), no-privileges-required (PR:N), no-user-interaction (UI:N) attack with high availability impact but zero confidentiality or integrity impact (VC:N/VI:N/VA:H). The E:U (unexploited) temporal modifier accurately signals no known active exploitation at time of scoring, and the vulnerability is absent from the CISA KEV catalog. No EPSS data was provided; however, given that the attack requires only a single unauthenticated HTTP request to any POST endpoint and completely disables the instance, real-world risk is materially higher than the base score suggests for organizations with internet-exposed GHES instances or adversaries with internal network access. The lack of authentication or configuration prerequisites means any network-reachable attacker can attempt this trivially, making patch urgency high for exposed instances despite the absence of confirmed exploitation. |
| Exploit ScenarioDerived | An unauthenticated attacker with network access to the GitHub Enterprise Server instance sends a single HTTP POST request to any endpoint (such as the login page or a public API route) with a form-encoded body containing parameters nested to an extreme depth, such as a[b][c][d]...[z]=1 repeated thousands of levels. The server's body parser recursively descends into the structure before any routing or authentication logic executes, consuming CPU until the process is blocked or killed, and repeating this at a modest request rate quickly saturates all available worker processes, rendering the instance unable to service legitimate requests. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 05, 2026
Denial of service in GitHub Enterprise Server allows unauthenticated remote attackers to render an instance fully unresponsive by submitting a crafted form-encoded HTTP POST request containing deeply nested parameters, triggering uncontrolled recursive parsing that exhausts both CPU and the pool of request-handling worker processes. Because parameter parsing occurs before routing and authentication checks, every POST endpoint on the instance serves as a viable attack surface, requiring no foothold or prior knowledge of application structure. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.0 E:U modifier confirms no known active exploitation at the time of scoring. GitHub has released patches across four supported release trains.
RemediationAI
The primary remediation is upgrading to one of the patched releases: 3.17.16, 3.18.10, 3.19.7, or 3.20.3, per GitHub's official release notes. Administrators should apply the patch corresponding to their current release train as soon as operationally feasible. For organizations that cannot immediately patch, compensating controls include deploying a reverse proxy or WAF in front of the GHES instance configured to enforce a maximum request body nesting depth or reject form-encoded payloads exceeding a defined parameter count threshold - though this may inadvertently block legitimate deep-nested form submissions and requires testing. Rate-limiting POST requests per source IP at the network perimeter can reduce the blast radius of an attack but will not prevent a determined attacker from sustaining the DoS from multiple sources. Restricting network-level access to the GHES instance to trusted IP ranges is the strongest compensating control where possible, since it eliminates unauthenticated remote attack surface entirely. No side effects are expected from upgrading within the same release train.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-674 (Uncontrolled Recursion): the server's form-encoded body parser does not impose a depth limit on nested parameter structures, causing recursive descent into deeply nested parameter trees that consumes CPU proportional to nesting depth. Because HTTP body parsing in GitHub Enterprise Server is performed as a pre-routing middleware step - before authentication or route-specific logic - any valid POST endpoint can be used to trigger the condition without credentials. The affected product is identified via CPE cpe:2.3:a:github:enterprise_server:*:*:*:*:*:*:*:*, covering the self-hosted appliance distribution of GitHub's platform. The pattern is consistent with algorithmic complexity / ReDoS-class DoS issues where attacker-controlled input drives exponential or deeply recursive internal computation.
Know when Github gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Network-reachable with no authentication or configuration prerequisites; impact is purely availability (complete DoS), with no confidentiality or integrity effect.
Primary rating from Vendor (GitHub_P).
CVSS VectorVendor: GitHub_P
DescriptionCVE.org
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing and authentication, any POST endpoint could be used to trigger the condition, which could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Supply chain vulnerability in Eclipse Theia GitHub Actions workflow. The preview.yml workflow uses pull_request_target w
Supply chain attack vector in OpenLIT GitHub Actions workflows. The pull_request_target trigger with checkout enables ma
Eigent multi-agent workflow CI pipeline (ci.yml) uses pull_request_target with checkout of untrusted PR code, enabling a
An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. R
cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Rated critical severity (CVSS 9.
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowe
Unauthenticated infrastructure overwrite in Hoppscotch API development ecosystem before 2026.2.0. Attackers can overwrit
A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCrede
OneUptime versions prior to 10.0.19 allow unauthenticated attackers to hijack GitHub App integrations across projects by
PolarLearn versions 0-PRERELEASE-15 and earlier lack proper state parameter validation in OAuth 2.0 authentication, enab
Path traversal in esm.sh CDN prior to version 0.0.0-20260116051925-c62ab83c589e allows unauthenticated remote attackers
actions/artifact is the GitHub ToolKit for developing GitHub Actions. Rated high severity (CVSS 7.5), this vulnerability
Exploit-DB