GitHub has released Enterprise Server version 3.20.3, addressing two critical-severity vulnerabilities, two high-severity flaws, and several operational bugs.
Administrators are urged to act immediately, as one of the critical issues requires manual GPG key rotation before upgrading.
The most urgent update in this release involves a revoked signing key for GHES release packages. GitHub has rotated its GPG signing key, meaning all future release packages will be signed exclusively with the new key.
Before administrators can apply the 3.20.3 patch, they must manually rotate the GPG public keys on their instance using a GitHub-developed script detailed in GitHub’s official investigation update blog post.
Multiple GitHub Enterprise Server Vulnerabilities patched
The critical flaw, tracked as CVE-2026-9312, is a pre-authentication server-side request forgery (SSRF) vulnerability in an upload endpoint.
An attacker with network access to a GHES instance could send crafted requests to internal services by exploiting insufficient input validation, potentially exposing sensitive credentials and accessing restricted internal infrastructure.
GitHub patched this by enforcing strict input validation on request parameters. The vulnerability was responsibly disclosed through the GitHub Bug Bounty program.
Two high-severity Linux kernel vulnerabilities CVE-2026-43284 and CVE-2026-43500 affecting the IPsec ESP and RxRPC networking subsystems (collectively known as “Dirty Frag”) could allow a local attacker to escalate privileges to root.
These flaws require local access to the instance but pose a significant risk in shared or multi-tenant deployment environments.
A second high-severity issue, CVE-2026-8606, combined two attack vectors. An attacker could extract sensitive environment variables through a timing side-channel attack targeting the security advisories package lookup feature.
Additionally, on instances with GitHub Packages enabled, a missing package name validation allowed SSRF to internal services.
This attack required no authentication when private mode was disabled. GitHub mitigated this by fully removing the affected endpoint from GHES.
Bug Fixes
Beyond security patches, version 3.20.3 resolves several notable bugs:
- Nomad service start/stop events no longer fail to trigger snapshot actions, improving resilience
- Images uploaded before a 3.13 upgrade now render correctly in markdown tables
- Custom secret scanning patterns could previously bypass wildcard restrictions via capture groups, causing performance degradation this is now blocked.
- A phantom Copilot tab in GitHub App settings has been removed, as Copilot configuration is unsupported in GHES
This release also ships meaningful infrastructure improvements. The default memory limit for the OpenTelemetry collector has been quadrupled from 1024 MiB to 4096 MiB to prevent metric loss due to memory exhaustion.
Cluster Management Consoles now display Nomad health check data regardless of which node is selected, and the collectd Nomad plugin has been updated to shorten metric names that exceeded the 128-character limit, resolving metric collection gaps in cluster deployments.
Administrators running GHES in production environments should prioritize this update, beginning with the mandatory GPG key rotation step outlined in GitHub’s security advisory before proceeding with the standard upgrade workflow.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
