Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-20T18:39:03 libgit2: libgit2: Network attacker can intercept HTTPS connections via inverted IP SubjectAltName comparison 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CWE-295

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. OpenSSL builds reject matching IP addresses and accept mismatched IP addresses, allowing a network attacker with a CA-trusted certificate containing any IP SubjectAltName to intercept libgit2 connections to IP-literal HTTPS URLs. DNS SubjectAltName validation and non-OpenSSL TLS backends are not affected. This issue is fixed in versions 1.8.6 and 1.9.5.

A flaw was found in libgit2, a C library for Git functionality. An inverted comparison in the OpenSSL backend's certificate verification logic, specifically when handling IP-literal hosts and certificate IP SubjectAltNames, allows a network attacker to intercept HTTPS connections. By presenting a CA-trusted certificate with any IP SubjectAltName, an attacker can trick libgit2 into accepting a mismatched IP address, leading to the interception of sensitive communication.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Hardened Images 2026-08-25T00:00:00Z RHSA-2026:59361 libgit2-main-1.9.7-1.hum1 Red Hat Enterprise Linux 10 Fix deferred rust Red Hat Enterprise Linux 8 Fix deferred libgit2 Red Hat Enterprise Linux 9 Fix deferred rust Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred libgit2 Red Hat Enterprise Linux AI (RHEL AI) 3 Fix deferred rust https://www.cve.org/CVERecord?id=CVE-2026-53583 https://nvd.nist.gov/vuln/detail/CVE-2026-53583 https://github.com/libgit2/libgit2/commit/647dcb432980b84ede4cb5a008bbd1ccb4ead03d https://github.com/libgit2/libgit2/commit/c2aa35409ee0e6515df64da49750f13a0a42c47f https://github.com/libgit2/libgit2/commit/ef086bc3e4eedf62be38a910381aae24d49871ff https://github.com/libgit2/libgit2/releases/tag/v1.8.6 https://github.com/libgit2/libgit2/releases/tag/v1.9.5 https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp