An out‑of‑bounds read was discovered in GitHub Enterprise Server’s Git service (babeld). When an SSH client proves possession of a host key, the SSH implementation incorrectly sized the session identifier to the digest length declared by the client instead of its own. An attacker who can SSH into the server and has an account can re‑key to an algorithm with a longer hash, causing nearby process memory to be signed and sent back to the client. Because only a limited amount of that memory may be recovered, the flaw primarily enables the disclosure of internal data, which could include sensitive credentials or code segments, leading to a data exposure vulnerability.

GitHub Enterprise Server versions before 3.19.14, 3.20.10, 3.21.8, and 3.22.3 are affected. Specifically, any release of GitHub Enterprise Server deployed prior to these patch releases is vulnerable. The issue resides in the Git service component, and the problem is confined to servers running those older versions.

The CVSS score of 5.3 classifies this as a moderate severity vulnerability, and the EPSS score is currently unavailable. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have legitimate SSH access to the server and an account. Once those conditions are met, the attacker can modify the SSH key exchange to use a hash function with a longer digest, triggering the out‑of‑bounds read and leakage of adjacent memory. Because it requires authenticated access, the attack surface is limited to users who already have SSH credentials, making mitigation through access controls and patching crucial.