CVE-2026-53583 in libgit2
Summary
by MITRE • 08/20/2026
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. OpenSSL builds reject matching IP addresses and accept mismatched IP addresses, allowing a network attacker with a CA-trusted certificate containing any IP SubjectAltName to intercept libgit2 connections to IP-literal HTTPS URLs. DNS SubjectAltName validation and non-OpenSSL TLS backends are not affected. This issue is fixed in versions 1.8.6 and 1.9.5.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified as CVE-2024-37890 represents a critical logic error within the libgit2 library, specifically affecting its TLS certificate verification mechanisms when utilizing OpenSSL backends. Libgit2 serves as a portable C implementation of Git core methods, enabling developers to integrate version control functionality directly into applications via a linkable API. The flaw resides in the verify_server_cert function located in src/libgit2/streams/openssl.c. This component is responsible for validating that the server presenting an SSL/TLS certificate actually owns the domain or IP address being connected to. In this specific instance, the code handles the comparison between the host provided by the user and the Subject Alternative Name (SAN) extensions present in the server's certificate. The issue manifests exclusively when connecting via an IPv4 or IPv6 literal rather than a DNS hostname, triggering the GEN_IPADD branch of the validation logic.
The technical root cause is an inverted logical negation applied to the result of the memcmp function used for comparing IP addresses. In C programming, memcmp returns zero if two memory blocks are identical and non-zero otherwise. The correct verification logic should reject connections where the comparison yields a non-zero value (indicating mismatch). However, due to the erroneous double negation operator !!memcmp, the code effectively treats a match as a failure condition or vice versa depending on the specific implementation details of how the return value is interpreted in the conditional statement. This inversion causes OpenSSL builds linked with libgit2 to reject valid certificates where the IP addresses actually match and, more dangerously, accept mismatched certificates where they do not match. Consequently, if an attacker possesses a CA-trusted certificate containing any arbitrary IP SubjectAltName, they can successfully intercept connections made by vulnerable versions of libgit2 to HTTPS URLs specified with literal IP addresses.
This vulnerability has severe operational implications for network security and data integrity. By allowing the acceptance of mismatched certificates, the flaw effectively disables hostname or IP address verification during TLS handshakes for affected configurations. This enables a man-in-the-middle attack scenario where an adversary can intercept, read, or modify traffic intended for legitimate servers without triggering certificate warnings in applications relying on libgit2 with OpenSSL backends. The impact is particularly acute because it bypasses one of the primary defenses against credential theft and data exfiltration over encrypted channels. It allows attackers to perform active interception attacks even when valid CA-signed certificates are used, undermining the trust model established by Public Key Infrastructure systems.
It is important to note that this vulnerability does not affect all configurations equally. DNS Subject Alternative Name validation remains unaffected because the flawed code path is specific to IP literal comparisons. Furthermore, non-OpenSSL TLS backends utilized by libgit2 are also immune to this particular logic error, as the bug is confined to the OpenSSL-specific implementation details within streams/openssl.c. This distinction highlights that while the core library has a flaw in one of its optional dependencies, applications using alternative SSL libraries or connecting via DNS names may remain secure from this specific exploit vector.
To mitigate this risk, organizations and developers must upgrade libgit2 to version 1.8.6 or later for stable branches, or version 1.9.5 and above for development branches. These releases contain the corrected logic that properly validates IP address matches during certificate verification. For applications unable to update immediately due to dependency constraints, implementing additional validation layers at the application level or switching to a TLS backend not affected by this OpenSSL-specific bug can provide temporary relief. However, upgrading remains the definitive solution as it addresses the root cause within the library itself.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-754: Improper Check for Unusual or Exceptional Conditions. The failure to correctly validate that the presented certificate matches the intended host constitutes an improper check against expected conditions during authentication. In terms of adversary tactics, this flaw facilitates MITM (Man-in-the-Middle) attacks consistent with ATT&CK technique T1072: Software Deployment Tools if used for lateral movement or interception, and more broadly supports credential harvesting by allowing undetected eavesdropping on encrypted communications. The exploitation requires the attacker to have a CA-trusted certificate, which implies they may control a compromised Certificate Authority or possess valid certificates from less scrutinized issuers, making this an issue of both implementation error and trust management.