CVE-2026-53583
Received Received - Intake

OpenSSL Certificate IP Validation Bypass in libgit2

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. OpenSSL builds reject matching IP addresses and accept mismatched IP addresses, allowing a network attacker with a CA-trusted certificate containing any IP SubjectAltName to intercept libgit2 connections to IP-literal HTTPS URLs. DNS SubjectAltName validation and non-OpenSSL TLS backends are not affected. This issue is fixed in versions 1.8.6 and 1.9.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-53583
EUVD
EUVD-2026-63549

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
libgit2 libgit2 to 1.8.6 (inc)
libgit2 libgit2 to 1.9.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.
CWE-297 The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects libgit2, a Git implementation library, when using the OpenSSL backend. It involves an inverted comparison in IP SubjectAltName (SAN) verification within the verify_server_cert() function. The bug causes matching IP addresses to be rejected and mismatched ones to be accepted, allowing attackers with a valid CA-signed certificate containing any IP SAN to bypass hostname verification for HTTPS URLs with IP-literal addresses.

Detection Guidance

To detect this vulnerability, check the version of libgit2 in use with commands like 'git2 --version' or inspect the library path in your application. If using a vulnerable version (before 1.8.6 or 1.9.5) with OpenSSL backend, the system is at risk. Network monitoring for unexpected certificate validation failures or MITM attempts may also indicate exploitation.

Impact Analysis

An attacker could perform man-in-the-middle (MITM) attacks to intercept or alter data sent between libgit2 clients and servers using IP-literal HTTPS URLs. This may lead to credential theft, code injection, or supply chain attacks in CI/CD pipelines. Legitimate connections to IP-literal URLs may also fail due to incorrect validation.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling man-in-the-middle attacks that intercept sensitive data transmitted over HTTPS connections to IP-literal URLs. GDPR requires secure data transmission and protection against unauthorized access, while HIPAA mandates safeguards for protected health information. The flaw allows attackers to bypass certificate validation, potentially exposing confidential data.

Mitigation Strategies

Upgrade libgit2 to version 1.8.6 or 1.9.5 or later immediately. If upgrading is not possible, disable the OpenSSL backend and switch to a non-vulnerable TLS backend like mbedTLS or Windows Schannel. Review and revoke any certificates containing IP SubjectAltName entries used in your environment.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53583. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart