Executive brief
libgit2 is a library that provides Git functionality to applications. The OpenSSL backend contains a logic error in certificate validation that inverts the IP address matching check, causing valid certificates to be rejected and invalid certificates to be accepted. An attacker with any CA-trusted certificate could intercept HTTPS connections to IP-based Git repositories, potentially compromising repository integrity and enabling man-in-the-middle attacks.
Technical details
The vulnerability is an inverted memcmp() logic error in verify_server_cert() within src/libgit2/streams/openssl.c's GEN_IPADD branch. The function incorrectly uses !!memcmp() to compare IP SubjectAltName entries; since memcmp() returns 0 for matches and non-zero for mismatches, the !! operator inverts this: matching IPs evaluate to false (rejected) while mismatched IPs evaluate to true (accepted). An attacker with a valid CA-signed certificate containing any IP SubjectAltName can bypass hostname verification for IP-literal HTTPS URLs. The vulnerability only affects OpenSSL-based TLS backends; DNS SubjectAltName validation and non-OpenSSL backends are unaffected. The fix is available in libgit2 versions 1.8.6 and 1.9.5.
Affected products
- libgit2 libgit2 before 1.8.6 and before 1.9.5
Timeline
- 2026-08-20: disclosed
- 2026-08-20: patched: fixed in versions 1.8.6 and 1.9.5