A denial of service vulnerability exists in GitHub Enterprise Server that allows an unauthenticated attacker to exhaust the pool of request‑handling worker processes and consume excessive CPU by sending a crafted form‑encoded HTTP POST request with deeply nested parameters. Because request parameters are parsed before routing and authentication, any POST endpoint can trigger the condition, rendering the instance unresponsive. The associated weakness is CWE‑674.

Vendors affected are GitHub Enterprise Server. All versions preceding 3.21 are vulnerable. The issue is fixed in releases 3.20.3, 3.19.7, 3.18.10, and 3.17.16.

The CVSS score of 6.6 indicates a moderate impact, and the EPSS score is not available, so the likelihood of exploitation is uncertain but not considered high. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the denial of service by sending any unauthenticated POST request with deep nesting, so the vector is inferred to be HTTP over the network. Since the flaw is generic to all POST endpoints, the risk extends broadly to any externally reachable instance of GitHub Enterprise Server that has not applied the patch.