CVE-2026-15007 GitHub CVE debrief

Who should care

Administrators and users of GitHub Enterprise Server prior to version 3.22 should be aware of this vulnerability and take steps to mitigate it. This includes updating to a fixed version and restricting access to repository release notes configuration files. Monitoring for suspicious activity related to repository release notes is also recommended.

Technical summary

The vulnerability allows an authenticated user to cause service disruption by supplying a repository release notes configuration file containing deeply nested YAML. When release notes are generated, the configuration file is parsed without a nesting depth limit, causing excessive resource consumption that could render the instance unresponsive. This affects all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.18, 3.18.12, 3.19.9, 3.20.5, and 3.21.3.

Defensive priority

Medium

Recommended defensive actions

• Update to a fixed version of GitHub Enterprise Server (3.17.18, 3.18.12, 3.19.9, 3.20.5, or 3.21.3)
• Restrict access to repository release notes configuration files
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported via the GitHub Bug Bounty program. Affected versions of GitHub Enterprise Server include all versions prior to 3.22. The issue arises from the parsing of deeply nested YAML in repository release notes configuration files without a nesting depth limit, leading to excessive resource consumption. This could render the instance unresponsive. Evidence is limited to public sources and vendor statements. Defenders should verify instance configurations and monitor for suspicious activity related to repository release notes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.