Vulnerability · Published Aug 20, 2026 · Assigned by GitHub_M

CVE-2026-53583libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend

Medium 6.5

In plain English

A medium-severity improper certificate validation in libgit2 from libgit2. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 85.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. OpenSSL builds reject matching IP addresses and accept mismatched IP addresses, allowing a network attacker with a CA-trusted certificate containing any IP SubjectAltName to intercept libgit2 connections to IP-literal HTTPS URLs. DNS SubjectAltName validation and non-OpenSSL TLS backends are not affected. This issue is fixed in versions 1.8.6 and 1.9.5.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.23	libgit2	1.9.6-r0	ALPINE-CVE-2026-53583
Alpine:v3.24	libgit2	1.9.6-r0	ALPINE-CVE-2026-53583
Debian:13	libgit2	1.9.0+ds-2+deb13u1	DEBIAN-CVE-2026-53583
Debian:14	libgit2	1.9.6+ds-1	DEBIAN-CVE-2026-53583
Ubuntu:24.04:LTS	libgit2	1.7.2+ds-1ubuntu3.3	USN-8907-1
Ubuntu:24.04:LTS	libgit2	1.7.2+ds-1ubuntu3.3	UBUNTU-CVE-2026-53583
Ubuntu:26.04:LTS	libgit2	1.9.1+ds-1ubuntu1.3	USN-8907-1
Ubuntu:26.04:LTS	libgit2	1.9.1+ds-1ubuntu1.3	UBUNTU-CVE-2026-53583

Affected products (as reported)

Vendor	Product	Versions
libgit2	libgit2	< 1.8.6>= 1.9.0, < 1.9.5

Weakness: CWE-295, CWE-297 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp x_refsource_CONFIRM
https://github.com/libgit2/libgit2/commit/647dcb432980b84ede4cb5a008bbd1ccb4ead03d x_refsource_MISC
https://github.com/libgit2/libgit2/commit/c2aa35409ee0e6515df64da49750f13a0a42c47f x_refsource_MISC
https://github.com/libgit2/libgit2/commit/ef086bc3e4eedf62be38a910381aae24d49871ff x_refsource_MISC
https://github.com/libgit2/libgit2/releases/tag/v1.8.6 x_refsource_MISC
https://github.com/libgit2/libgit2/releases/tag/v1.9.5 x_refsource_MISC