Out-of-Bounds Read Vulnerability in GitHub Enterprise Server's SSH Implementation

CVE-2026-118237

What is CVE-2026-118237?

An out-of-bounds read vulnerability was discovered in the SSH implementation of GitHub Enterprise Server's Git service (babeld). This issue arises during the process of proving possession of a host key, where babeld incorrectly sizes the session identifier based on the current digest length instead of its intended size. If an attacker with an account and SSH access exploits this flaw, they can effectively change the re-keying algorithm to one with a longer hash, potentially leaking memory contents. This could allow the attacker to access sensitive information that resides in adjacent process memory. The vulnerability impacts all versions prior to 3.23 and has been remedied in updates to versions 3.22.3, 3.21.8, 3.20.10, and 3.19.14. This vulnerability was reported via the GitHub Bug Bounty program.

References