Description

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. OpenSSL builds reject matching IP addresses and accept mismatched IP addresses, allowing a network attacker with a CA-trusted certificate containing any IP SubjectAltName to intercept libgit2 connections to IP-literal HTTPS URLs. DNS SubjectAltName validation and non-OpenSSL TLS backends are not affected. This issue is fixed in versions 1.8.6 and 1.9.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-20T19:16:54.500Z",
  "pubdate": "2026-08-20T19:16:54.500Z",
  "executiveSummary": "A logic flaw exists in libgit2 prior to versions 1.8.6 and 1.9.5 within the OpenSSL TLS stream implementation, specifically affecting hostname verification for IP-literal URLs.\nThe vulnerability involves an inverted boolean comparison result during the validation of Subject Alternative Name (SAN) IP addresses against the target server's IP-literal address.\nThis cryptographic validation failure causes the OpenSSL backend to incorrectly reject valid matching IP addresses and conversely accept mismatched IP addresses.\nAn unauthenticated network attacker in a man-in-the-middle position, possessing a CA-trusted certificate containing any IP SubjectAltName, can successfully intercept and decrypt libgit2 HTTPS connections targeting IP-literal hosts.\nDNS-based SubjectAltName validation and alternative TLS backends remain unaffected by this defect.\nThe risk is mitigated by upgrading libgit2 to version 1.8.6 or 1.9.5, where the flawed validation logic is corrected.",
  "technicalDetails": "The vulnerability resides in the verify_server_cert function located within the source file src/libgit2/streams/openssl.c.\nThe root cause stems from the incorrect usage of an inverted double-exclamation operator (!!memcmp) within the GEN_IPADD branch of the certificate validation routine.\nWhen libgit2 compares an IP-literal host with an IP SubjectAltName presented in the server certificate, the memory comparison function memcmp returns zero on a successful match. The application of the !! operator transforms this return value, causing a cryptographic match to evaluate as false and a cryptographic mismatch to evaluate as true.\nConsequently, the OpenSSL build rejects valid matching IP addresses and accepts mismatched IP addresses, breaking fundamental TLS server identity verification guarantees.\nTo exploit this vulnerability, a network attacker must be positioned on the network path between the libgit2 client and the target server to intercept HTTPS traffic.\nThe attacker requires a valid CA-trusted X.509 certificate that includes any arbitrary IP SubjectAltName entry.\nWhen a client initiates an HTTPS connection to an IP-literal URL using the vulnerable libgit2 OpenSSL backend, the client presents the server-supplied certificate to the validation logic.\nBecause of the inverted memcmp evaluation, the verification mechanism falsely validates the mismatched certificate as authentic.\nThe TLS handshake completes successfully, allowing the attacker to perform adversary-in-the-middle (AitM) interception, read sensitive repository data, or inject malicious payloads into the libgit2 connection.\nThe affected components are libgit2 versions prior to 1.8.6 and 1.9.5 utilizing the OpenSSL transport backend. No authentication or elevated privileges are required by the attacker beyond network access and a validly issued certificate from a trusted Certificate Authority."
}