CVE-2026-53583

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53583", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-09T19:11:53.484Z", "datePublished": "2026-08-20T18:39:03.676Z", "dateUpdated": "2026-08-20T19:04:42.247Z"}, "containers": {"cna": {"title": "libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend", "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "lang": "en", "description": "CWE-295: Improper Certificate Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-297", "lang": "en", "description": "CWE-297: Improper Validation of Certificate with Host Mismatch", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp"}, {"name": "https://github.com/libgit2/libgit2/commit/647dcb432980b84ede4cb5a008bbd1ccb4ead03d", "tags": ["x_refsource_MISC"], "url": "https://github.com/libgit2/libgit2/commit/647dcb432980b84ede4cb5a008bbd1ccb4ead03d"}, {"name": "https://github.com/libgit2/libgit2/commit/c2aa35409ee0e6515df64da49750f13a0a42c47f", "tags": ["x_refsource_MISC"], "url": "https://github.com/libgit2/libgit2/commit/c2aa35409ee0e6515df64da49750f13a0a42c47f"}, {"name": "https://github.com/libgit2/libgit2/commit/ef086bc3e4eedf62be38a910381aae24d49871ff", "tags": ["x_refsource_MISC"], "url": "https://github.com/libgit2/libgit2/commit/ef086bc3e4eedf62be38a910381aae24d49871ff"}, {"name": "https://github.com/libgit2/libgit2/releases/tag/v1.8.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/libgit2/libgit2/releases/tag/v1.8.6"}, {"name": "https://github.com/libgit2/libgit2/releases/tag/v1.9.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/libgit2/libgit2/releases/tag/v1.9.5"}], "affected": [{"vendor": "libgit2", "product": "libgit2", "versions": [{"version": "< 1.8.6", "status": "affected"}, {"version": ">= 1.9.0, < 1.9.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T18:39:03.676Z"}, "descriptions": [{"lang": "en", "value": "libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. OpenSSL builds reject matching IP addresses and accept mismatched IP addresses, allowing a network attacker with a CA-trusted certificate containing any IP SubjectAltName to intercept libgit2 connections to IP-literal HTTPS URLs. DNS SubjectAltName validation and non-OpenSSL TLS backends are not affected. This issue is fixed in versions 1.8.6 and 1.9.5."}], "source": {"advisory": "GHSA-h7gc-w2gg-p9xp", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-20T19:03:44.491440Z", "id": "CVE-2026-53583", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T19:04:42.247Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53583", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T19:03:44.491440Z"}}}], "references": [{"url": "https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T19:02:30.259Z"}}], "cna": {"title": "libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend", "source": {"advisory": "GHSA-h7gc-w2gg-p9xp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "libgit2", "product": "libgit2", "versions": [{"status": "affected", "version": "< 1.8.6"}, {"status": "affected", "version": ">= 1.9.0, < 1.9.5"}]}], "references": [{"url": "https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp", "name": "https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/libgit2/libgit2/commit/647dcb432980b84ede4cb5a008bbd1ccb4ead03d", "name": "https://github.com/libgit2/libgit2/commit/647dcb432980b84ede4cb5a008bbd1ccb4ead03d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libgit2/libgit2/commit/c2aa35409ee0e6515df64da49750f13a0a42c47f", "name": "https://github.com/libgit2/libgit2/commit/c2aa35409ee0e6515df64da49750f13a0a42c47f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libgit2/libgit2/commit/ef086bc3e4eedf62be38a910381aae24d49871ff", "name": "https://github.com/libgit2/libgit2/commit/ef086bc3e4eedf62be38a910381aae24d49871ff", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libgit2/libgit2/releases/tag/v1.8.6", "name": "https://github.com/libgit2/libgit2/releases/tag/v1.8.6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libgit2/libgit2/releases/tag/v1.9.5", "name": "https://github.com/libgit2/libgit2/releases/tag/v1.9.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. OpenSSL builds reject matching IP addresses and accept mismatched IP addresses, allowing a network attacker with a CA-trusted certificate containing any IP SubjectAltName to intercept libgit2 connections to IP-literal HTTPS URLs. DNS SubjectAltName validation and non-OpenSSL TLS backends are not affected. This issue is fixed in versions 1.8.6 and 1.9.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-297", "description": "CWE-297: Improper Validation of Certificate with Host Mismatch"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T18:39:03.676Z"}}}, "cveMetadata": {"cveId": "CVE-2026-53583", "state": "PUBLISHED", "dateUpdated": "2026-08-20T19:04:42.247Z", "dateReserved": "2026-06-09T19:11:53.484Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T18:39:03.676Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "libgit2", "vendor": "libgit2", "versions": [{"status": "affected", "version": "< 1.8.6"}, {"status": "affected", "version": ">= 1.9.0, < 1.9.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. OpenSSL builds reject matching IP addresses and accept mismatched IP addresses, allowing a network attacker with a CA-trusted certificate containing any IP SubjectAltName to intercept libgit2 connections to IP-literal HTTPS URLs. DNS SubjectAltName validation and non-OpenSSL TLS backends are not affected. This issue is fixed in versions 1.8.6 and 1.9.5."}, {"lang": "es", "value": "libgit2 es una implementaci\u00f3n port\u00e1til en C de los m\u00e9todos centrales de Git proporcionada como una biblioteca enlazable con una API s\u00f3lida, permitiendo integrar la funcionalidad de Git en su aplicaci\u00f3n. Antes de 1.8.6 y 1.9.5, verify_server_cert en src/libgit2/streams/openssl.c usa un resultado !!memcmp invertido en la rama GEN_IPADD al comparar un host literal de IP con un SubjectAltName de IP de certificado. Las compilaciones de OpenSSL rechazan las direcciones IP coincidentes y aceptan las direcciones IP no coincidentes, permitiendo a un atacante de red con un certificado de confianza de CA que contenga cualquier SubjectAltName de IP interceptar conexiones de libgit2 a URLs HTTPS literales de IP. La validaci\u00f3n de DNS SubjectAltName y los backends TLS que no son de OpenSSL no se ven afectados. Este problema est\u00e1 solucionado en las versiones 1.8.6 y 1.9.5."}], "id": "CVE-2026-53583", "lastModified": "2026-10-26T10:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53583", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T19:03:44.491440Z", "version": "2.0.3"}}]}, "published": "2026-08-20T19:16:54.500", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/libgit2/libgit2/commit/647dcb432980b84ede4cb5a008bbd1ccb4ead03d"}, {"source": "security-advisories@github.com", "url": "https://github.com/libgit2/libgit2/commit/c2aa35409ee0e6515df64da49750f13a0a42c47f"}, {"source": "security-advisories@github.com", "url": "https://github.com/libgit2/libgit2/commit/ef086bc3e4eedf62be38a910381aae24d49871ff"}, {"source": "security-advisories@github.com", "url": "https://github.com/libgit2/libgit2/releases/tag/v1.8.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/libgit2/libgit2/releases/tag/v1.9.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}, {"lang": "en", "value": "CWE-297"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "libgit2: libgit2: Network attacker can intercept HTTPS connections via inverted IP SubjectAltName comparison", "id": "2520694", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520694"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-295", "details": ["libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. OpenSSL builds reject matching IP addresses and accept mismatched IP addresses, allowing a network attacker with a CA-trusted certificate containing any IP SubjectAltName to intercept libgit2 connections to IP-literal HTTPS URLs. DNS SubjectAltName validation and non-OpenSSL TLS backends are not affected. This issue is fixed in versions 1.8.6 and 1.9.5.", "A flaw was found in libgit2, a C library for Git functionality. An inverted comparison in the OpenSSL backend's certificate verification logic, specifically when handling IP-literal hosts and certificate IP SubjectAltNames, allows a network attacker to intercept HTTPS connections. By presenting a CA-trusted certificate with any IP SubjectAltName, an attacker can trick libgit2 into accepting a mismatched IP address, leading to the interception of sensitive communication."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-53583", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "libgit2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "libgit2", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rust", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "libgit2", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-08-20T18:39:03Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53583\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53583\nhttps://github.com/libgit2/libgit2/commit/647dcb432980b84ede4cb5a008bbd1ccb4ead03d\nhttps://github.com/libgit2/libgit2/commit/c2aa35409ee0e6515df64da49750f13a0a42c47f\nhttps://github.com/libgit2/libgit2/commit/ef086bc3e4eedf62be38a910381aae24d49871ff\nhttps://github.com/libgit2/libgit2/releases/tag/v1.8.6\nhttps://github.com/libgit2/libgit2/releases/tag/v1.9.5\nhttps://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.8.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.9.0,1.9.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "libgit2", "source": "cna", "vendor": "libgit2"}, "product": "libgit2", "vendor": "libgit2"}], "created": "2026-08-20T20:30:05.363997+00:00", "updated": "2026-08-21T02:00:05.422510+00:00", "vendors": ["libgit2", "libgit2$PRODUCT$libgit2"]}