CVE-2026-53583: libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verifyservercert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GENIPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. OpenSSL builds reject matching IP addresses and accept mismatched IP addresses, allowing a network attacker with a CA-trusted certificate containing any IP SubjectAltName to intercept libgit2 connections to IP-literal HTTPS URLs. DNS SubjectAltName validation and non-OpenSSL TLS backends are not affected. This issue is fixed in versions 1.8.6 and 1.9.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libgit2to a version that resolves this vulnerability.Fixed in 1.8.6 - Upgrade
Upgrade
libgit2to a version that resolves this vulnerability.Fixed in 1.9.5
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Affected deployments use libgit2 before 1.8.6 or 1.9.5, are built with the OpenSSL TLS backend, and connect to HTTPS URLs using an IP address literal as the host. DNS-based hostnames and non-OpenSSL TLS backends are not affected.
What does an attacker need to exploit it?
An attacker needs a network position to intercept the connection and a certificate trusted by the client’s CA store that contains any IP SubjectAltName. No authentication or user interaction is required.
What should be done if an immediate upgrade is not possible?
Avoid using IP-literal HTTPS URLs with affected OpenSSL-based libgit2 builds; use DNS hostnames instead. Upgrade to libgit2 1.8.6 or 1.9.5 when possible.
How can I determine whether a connection may have been vulnerable?
Check whether the application uses an affected libgit2 version with the OpenSSL backend and accesses HTTPS remotes by IP address rather than DNS name. The vulnerable validation path is specifically the certificate IP SubjectAltName comparison for IP-literal hosts.