CVE-2026-53583 libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend
A logic error in libgit2's OpenSSL backend allows attackers to bypass IP-based certificate validation, enabling man-in-the-middle attacks on IP-literal HTTPS connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53583?
CVE-2026-53583 is a medium-severity vulnerability in libgit2, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. OpenSSL builds reject matching IP addresses and accept mismatched IP addresses, allowing a network attacker with a CA-trusted certificate containing any IP SubjectAltName to intercept libgit2 connections to IP-literal HTTPS URLs. DNS SubjectAltName validation and non-OpenSSL TLS backends are not affected. This issue is fixed in versions 1.8.6 and 1.9.5.
Which versions are affected by CVE-2026-53583?
How do I fix CVE-2026-53583?
Upgrade to a fixed version.
Is CVE-2026-53583 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53583 exists.
Sources
Also known as AZL-96971, BELL-CVE-2026-53583, DEBIAN-CVE-2026-53583, ECHO-417b-96b7-cd13, GHSA-h7gc-w2gg-p9xp, JLSEC-2026-1369 and 3 more.