CVE-2026-53583
Fixed in a distro release EPSS <1%CVSS 6.5
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. OpenSSL builds reject matching IP addresses and accept mismatched IP addresses, allowing a network attacker with a CA-trusted certificate containing any IP SubjectAltName to intercept libgit2 connections to IP-literal HTTPS URLs. DNS SubjectAltName validation and non-OpenSSL TLS backends are not affected. This issue is fixed in versions 1.8.6 and 1.9.5.
Products: libgit2
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | cargo | 1.97.0-2.amzn2 |
| Amazon Linux 2 | clippy | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust-analyzer | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust-debugger-common | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust-doc | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust-gdb | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust-src | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust-std-static | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust-toolset | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rust-toolset-srpm-macros | 1.97.0-2.amzn2 |
| Amazon Linux 2 | rustfmt | 1.97.0-2.amzn2 |
| Amazon Linux 2023 | cargo | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | clippy | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | libgit2 | 1.6.4-116.amzn2023 |
| Amazon Linux 2023 | libgit2-devel | 1.6.4-116.amzn2023 |
| Amazon Linux 2023 | rust | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-analyzer | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-debugger-common | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-doc | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-gdb | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-lldb | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-src | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-std-static | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-std-static-wasm32-unknown-unknown | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-std-static-wasm32-wasip1 | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-toolset | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rust-toolset-srpm-macros | 1.97.0-2.amzn2023 |
| Amazon Linux 2023 | rustfmt | 1.97.0-2.amzn2023 |
| Debian 13 | libgit2 | 1.9.0+ds-2+deb13u1 |
| Debian 14 | libgit2 | 1.9.6+ds-1 |
| Red Hat hummingbird 1 | libgit2 | 0:1.9.7-1.hum1 |
| Red Hat hummingbird 1 | libgit2-devel | 0:1.9.7-1.hum1 |
| Ubuntu 24.04 LTS | libgit2 | 1.7.2+ds-1ubuntu3.3 |
| Ubuntu 26.04 LTS | libgit2 | 1.9.1+ds-1ubuntu1.3 |
| Ubuntu Pro 14.04 LTS | libgit2 | no fix |
| Ubuntu Pro 16.04 LTS | libgit2 | no fix |
| Ubuntu Pro 18.04 LTS | libgit2 | no fix |
| Ubuntu Pro 20.04 LTS | libgit2 | no fix |
| Ubuntu Pro 22.04 LTS | libgit2 | no fix |
| openSUSE Tumbleweed | libgit2 | 1.9.6-1.1 |