Business

GitHub's August 17 Outage Traced to an Istio Autoscaling Misconfiguration.

GitHub published its official root cause analysis (RCA) for the 7-hour-47-minute outage on August 17. It started with an Istio sidecar autoscaling misconfiguration.

· Huuush

GitHub's August 17 Outage Traced to an Istio Autoscaling Misconfiguration

Key takeaways

  1. 1The August 17 GitHub outage ran from 13:28 to 21:15 UTC, about 7 hours and 47 minutes.
  2. 2According to the official RCA, an Istio sidecar autoscaling misconfiguration started it and spread into load balancer overload.
  3. 3GitHub published five prevention steps, including fixing the autoscaling policy and reviewing retry logic.
Gradient background image of an incident card posted on GitHub's official status page

On August 17, GitHub was down for nearly eight hours.
Issues, Pull Requests, Actions, the API, and Copilot all failed in succession.
The next day, GitHub posted its root cause analysis (RCA) on its official status page.

Seven hours and 47 minutes: what went down

Cassidy Williams, senior director of Developer Experience at GitHub, announced on X at 7:31 p.m. KST on August 18, 2026 that "the RCA for yesterday's outage is out."
According to the official GitHub status page incident report, the outage ran from 13:28 to 21:15 UTC on August 17, about 7 hours and 47 minutes.

At the peak, web and API error rates reached about 20%, and archive and raw file download error rates reached about 50%.
Authentication systems based on SAML and OIDC were affected as well.

It started with one sidecar failing to scale

The official RCA pointed to network saturation in a US Central data center.
The trigger was that Istio sidecar pods used in the service mesh hit their concurrency limit, but a misconfigured autoscaling policy kept them from scaling properly.

That bottleneck exhausted load balancer capacity, and "optimistic retry" logic added more load to the internal load balancers, so the failure cascaded.
GitHub also named VS Code's retry behavior, which amplified Copilot traffic, as one of the causes.

Prevention steps and practical takeaways

In the RCA, GitHub listed these steps: fixing the autoscaling policy for service mesh sidecars, auditing all Istio request and concurrency limits, reviewing retry behavior across gateways and clients, improving VS Code's Copilot retry logic, and strengthening load balancer monitoring and failover safeguards.

If your team runs a sidecar-proxy service mesh such as Istio, this is a good case for checking whether your autoscaling limits actually hold up during real traffic spikes.
It's also a reminder, when designing retry policies, that client-side "optimistic retries" can make load worse during an outage.

The 13th incident this month: when will the cause be explained?

This was the 13th separate incident GitHub has had in August 2026 (spread across nine days).
When developers asked whether there's a deeper architecture or distributed-systems problem, Williams only replied that "we publish monthly availability reports covering big and small issues and our response." There's still no separate explanation of a structural cause for the repeated outages.
The monthly availability report covering all of August is due in September.

Frequently asked questions

How long did the outage last?
From 13:28 to 21:15 UTC on August 17, about 7 hours and 47 minutes. Web and API error rates peaked around 20%, and archive and file download error rates around 50%.
What was the root cause?
In a US Central data center, Istio service mesh sidecars hit their concurrency limit but failed to scale because of an autoscaling policy misconfiguration. Load balancer overload and clients' optimistic retry logic then made it worse.
What is GitHub doing to prevent a repeat?
Five steps: fixing the sidecar autoscaling policy, auditing Istio request and concurrency limits, reviewing gateway and client retry behavior, improving VS Code's Copilot retry logic, and strengthening load balancer monitoring and failover.
Was this the only outage in August?
No. It was the 13th separate incident in August 2026, spread across nine days. A separate monthly availability report covering all of August is due in September.

Related articles