Loading vulnerability…
Inverted IP SubjectAltName Validation in libgit2's OpenSSL Backend
CVE-2026-53583 is a TLS server-identity validation vulnerability in libgit2's OpenSSL backend, fixed in versions 1.8.6 and 1.9.5. The verify_server_cert function uses an inverted !!memcmp result in its GEN_IPADD branch when comparing an IP-literal hostname with a certificate's IP SubjectAltName. Consequently, matching IP addresses are rejected while mismatched addresses are accepted. A network attacker presenting a CA-trusted certificate containing a mismatched IP SubjectAltName can impersonate an HTTPS endpoint accessed by its literal IP address. DNS SubjectAltName validation and non-OpenSSL TLS backends are unaffected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation undermines TLS server authentication and enables a machine-in-the-middle attack against affected HTTPS connections. An attacker can potentially read sensitive information, including credentials transmitted over the intercepted connection, and modify exchanged data. The inverted comparison also causes certificates with correctly matching IP SubjectAltNames to be rejected. The vulnerability is rated CVSS v3 6.5, with low confidentiality and integrity impacts and no assigned availability impact.
If you can’t patch tonight, do this now.
Avoid IP-literal HTTPS remote addresses and use DNS hostnames with correctly validated DNS SubjectAltNames instead. Where supported, use a non-OpenSSL TLS backend, which is unaffected. Preserve certificate verification; disabling it is not a safe workaround.
Patch, then assume compromise.
Upgrade libgit2 to version 1.8.6 or later in the 1.8 release line, or version 1.9.5 or later in the 1.9 release line. Alternatively, install the distribution's security-fixed packages; Debian 13 provides the fix in 1.9.0+ds-2+deb13u1, and Ubuntu addresses it through USN-8907-1. Applications bundling or statically linking libgit2 must be rebuilt or replaced with patched builds; updating only the system library does not fix embedded copies.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.