{"id":"CVE-2026-53583","summary":"libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend","details":"libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. OpenSSL builds reject matching IP addresses and accept mismatched IP addresses, allowing a network attacker with a CA-trusted certificate containing any IP SubjectAltName to intercept libgit2 connections to IP-literal HTTPS URLs. DNS SubjectAltName validation and non-OpenSSL TLS backends are not affected. This issue is fixed in versions 1.8.6 and 1.9.5.","aliases":["GHSA-h7gc-w2gg-p9xp"],"modified":"2026-08-22T10:47:45.780470Z","published":"2026-08-20T18:39:03.676Z","related":["openSUSE-SU-2026:11315-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-295","CWE-297"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53583.json"},"references":[{"type":"WEB","url":"https://github.com/libgit2/libgit2/releases/tag/v1.8.6"},{"type":"WEB","url":"https://github.com/libgit2/libgit2/releases/tag/v1.9.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53583.json"},{"type":"ADVISORY","url":"https://github.com/libgit2/libgit2/security/advisories/GHSA-h7gc-w2gg-p9xp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53583"},{"type":"FIX","url":"https://github.com/libgit2/libgit2/commit/647dcb432980b84ede4cb5a008bbd1ccb4ead03d"},{"type":"FIX","url":"https://github.com/libgit2/libgit2/commit/c2aa35409ee0e6515df64da49750f13a0a42c47f"},{"type":"FIX","url":"https://github.com/libgit2/libgit2/commit/ef086bc3e4eedf62be38a910381aae24d49871ff"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libgit2/libgit2","events":[{"introduced":"0"},{"introduced":"338e6fb681369ff0537719095e22ce9dc602dbf0"},{"fixed":"5853918c4c6a7b12f8becf4bd11ff4362ebb9020"},{"fixed":"f7a4071c766ceea3915415e22134cbe3e581c420"},{"fixed":"647dcb432980b84ede4cb5a008bbd1ccb4ead03d"},{"fixed":"c2aa35409ee0e6515df64da49750f13a0a42c47f"},{"fixed":"ef086bc3e4eedf62be38a910381aae24d49871ff"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.8.6"},{"introduced":"1.9.0"},{"fixed":"1.9.5"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.8.5","v1.9.4","v1.9.3","v1.9.2","v1.9.1","v1.8.4","v1.9.0","v1.8.3","v1.8.1","v1.8.0","v1.7.0","v1.6.3","v1.6.2","v1.6.1","v1.5.0","v1.3.0","v1.4.0","v1.2.0","v1.1.0","v1.0.0","v0.99.0","v0.28.0-rc1","v0.28.0","v0.27.0","v0.27.0-rc3","v0.26.0-rc2","v0.26.0","v0.27.0-rc1","v0.27.0-rc2","v0.26.0-rc1","v0.24.0","v0.24.0-rc1","v0.23.0","v0.23.0-rc2","v0.23.0-rc1","v0.22.0","v0.22.0-rc2","v0.22.0-rc1","v0.21.0","v0.18.0","v0.17.0","v0.16.0","v0.15.0","v0.14.0","v0.13.0","v0.12.0","v0.11.0","v0.10.0","v0.8.0","v0.3.0","v0.2.0","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53583.json","vanir_signatures_modified":"2026-08-22T10:47:45Z","vanir_signatures":[{"digest":{"line_hashes":["161163592757564595969332526842759641351","211848842349138299922078898038780968212","150678553108198291235507343758851396879","243595294194876164507250832174148284305","260389537651659206423006796518091961514","111247752267490302524130105154936124555","157166958937368593972319777643047511994","14077685195833109481790633948365565836","211479020404053345239813664263127410790","158673971632547545414188081025559933918","236782617318123956231007559998755265225","160046562868851252895684686586687525125","30857154250935804666614266446734606942","154944407122117528254105116676392307560","287732400818321933112008560485550651873","133646563724366978894573886906506650712"],"threshold":0.9},"id":"CVE-2026-53583-559c06d2","signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/ef086bc3e4eedf62be38a910381aae24d49871ff","target":{"file":"src/libgit2/streams/openssl.c"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/ef086bc3e4eedf62be38a910381aae24d49871ff","target":{"file":"src/libgit2/streams/openssl.c","function":"verify_server_cert"},"deprecated":false,"digest":{"function_hash":"194443070578024260421714920149812272884","length":2323},"id":"CVE-2026-53583-77a13ab1"},{"deprecated":false,"digest":{"function_hash":"194443070578024260421714920149812272884","length":2323},"id":"CVE-2026-53583-a9d9ed68","signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/c2aa35409ee0e6515df64da49750f13a0a42c47f","target":{"function":"verify_server_cert","file":"src/libgit2/streams/openssl.c"}},{"signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/647dcb432980b84ede4cb5a008bbd1ccb4ead03d","target":{"file":"src/libgit2/streams/openssl.c","function":"verify_server_cert"},"deprecated":false,"digest":{"function_hash":"194443070578024260421714920149812272884","length":2323},"id":"CVE-2026-53583-b59b2bd1","signature_type":"Function"},{"target":{"file":"src/libgit2/streams/openssl.c"},"deprecated":false,"digest":{"line_hashes":["161163592757564595969332526842759641351","211848842349138299922078898038780968212","150678553108198291235507343758851396879","243595294194876164507250832174148284305","260389537651659206423006796518091961514","111247752267490302524130105154936124555","157166958937368593972319777643047511994","14077685195833109481790633948365565836","211479020404053345239813664263127410790","158673971632547545414188081025559933918","236782617318123956231007559998755265225","160046562868851252895684686586687525125","30857154250935804666614266446734606942","154944407122117528254105116676392307560","287732400818321933112008560485550651873","133646563724366978894573886906506650712"],"threshold":0.9},"id":"CVE-2026-53583-c2a6ac27","signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/c2aa35409ee0e6515df64da49750f13a0a42c47f"},{"target":{"file":"src/libgit2/streams/openssl.c"},"deprecated":false,"digest":{"line_hashes":["161163592757564595969332526842759641351","211848842349138299922078898038780968212","150678553108198291235507343758851396879","243595294194876164507250832174148284305","260389537651659206423006796518091961514","111247752267490302524130105154936124555","157166958937368593972319777643047511994","14077685195833109481790633948365565836","211479020404053345239813664263127410790","158673971632547545414188081025559933918","236782617318123956231007559998755265225","160046562868851252895684686586687525125","30857154250935804666614266446734606942","154944407122117528254105116676392307560","287732400818321933112008560485550651873","133646563724366978894573886906506650712"],"threshold":0.9},"id":"CVE-2026-53583-cfe6bfb2","signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/647dcb432980b84ede4cb5a008bbd1ccb4ead03d"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}]}