CVE-2026-118237— Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service

Quick assessment

Affected

GitHub Enterprise Server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 GitHub Enterprise Server 的 Git 服务（babeld）中发现了一个越界读取漏洞。在验证主机密钥所有权时，babeld 的 SSH 实现使用当前摘要长度而非其自身的长度来确定会话标识符的大小。拥有账户并具备 SSH 访问权限的攻击者可以重新协商密钥，切换到使用更长哈希值的算法，从而导致相邻进程的内存被签名并返回给客户端，其中部分内存可能被恢复。该漏洞影响所有早于 3.23 的版本，并已在 3.22.3、3.21.8、3.20.10 和 3.19.14 版本中修复。此漏洞是通过 GitH

CVSS 5.3 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service

Source: CVE Program / CVE List V5

Vulnerability Description

An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld). When proving possession of a host key, babeld's SSH implementation sized the session identifier by the current digest length rather than its own. An attacker with an account and SSH access could re-key to an algorithm with a longer hash, causing adjacent process memory to be signed and returned to the client, where a limited amount of it may be recoverable. This vulnerability affected all releases prior to 3.23 and was fixed in versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
GitHub	Enterprise Server	3.19.0 ~ 3.19.*	-

II. Public POCs for CVE-2026-118237

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118237

请登录查看更多情报信息。

Other References for CVE-2026-118237 (4)

https://docs.github.com/en/enterprise-server@3.19/admin/release-notes#3.19.14 release-notes
https://docs.github.com/en/enterprise-server@3.21/admin/release-notes#3.21.8 release-notes
https://docs.github.com/en/enterprise-server@3.22/admin/release-notes#3.22.3 release-notes
https://docs.github.com/en/enterprise-server@3.20/admin/release-notes#3.20.10 release-notes

https://www.cve.org/CVERecord?id=CVE-2026-118237

Same Patch Batch · GitHub · 2026-11-03 · 3 CVEs total

CVE-2026-104608	7.7 HIGH	Use-after-free vulnerability in GitHub Enterprise Server allowed remote code execution in
CVE-2026-110288	5.3 MEDIUM	Cross-site request forgery vulnerability in GitHub Enterprise Server allowed deletion of s

IV. Related Vulnerabilities

Same product: Enterprise Server

Same vendor: GitHub

Same weakness: CWE-125