CVE-2026-118237Medium· 5.3▾ SunlitAn out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rath…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access could re-key to an algorithm with a longer hash, causing adjacent process memory to be signed and returned to the client, where a limited amount of it may be recoverable. This vulnerability affected all releases prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.
enterprise_server >= 3.19.0 < 3.19.*enterprise_server >= 3.20.0 < 3.20.*enterprise_server >= 3.21.0 < 3.21.*enterprise_server >= 3.22.0 < 3.22.*Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104608High· 7.7Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in the Git service
CVE-2026-110288Medium· 5.3Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of stored ChatOps configuration through the Management Console
CVE-2026-15343High· 8.6A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker with code execution inside a Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow …
CVE-2026-103620Medium· 6.0A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branc…
CVE-2024-6800Critical· 9.5An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizing publicly exposed signed federation metadata XML
CVE-2026-29783High· 7.8The shell tool within GitHub Copilot CLI versions prior to and including 0.0.422 can allow arbitrary code execution through crafted bash parameter expansion patterns