CyberRota Analysis
AI-GeneratedGitHub Enterprise Server is vulnerable to a denial of service attack that allows unauthenticated attackers to exhaust CPU resources and deplete request-handling worker processes by sending specially crafted HTTP POST requests with deeply nested parameters. This issue affects all versions prior to 3.21 and can lead to unresponsiveness of the server. Organizations using affected versions should prioritize applying the relevant updates to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing and authentication, any POST endpoint could be used to trigger the condition, which could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16.