CVE-2026-53583: 
Bat vulnerability analysis and mitigation

CVE-2026-53583 is an inverted IP SubjectAltName (SAN) comparison vulnerability in the OpenSSL TLS backend of libgit2 that allows network attackers to perform Man-in-the-Middle (MITM) attacks against clients connecting to IP-literal HTTPS URLs. The flaw affects all versions of libgit2 built with the OpenSSL backend (Linux/Unix systems); Fedora is not affected as it links the system PCRE2 instead of the bundled library. It was disclosed on July 18, 2026, with no vendor patch available at the time of disclosure. The CVSS v3.1 base score is 6.5 (Moderate) (GitHub Advisory).

The root cause is an inverted boolean logic error (CWE-295, CWE-297) in the verify_server_cert() function within src/libgit2/streams/openssl.c. The code uses !!memcmp(name, addr, namelen) to compare IP SAN entries: since memcmp() returns 0 for matching buffers, applying !! inverts the result — matching IPs yield matched = 0 (rejected) and mismatched IPs yield matched = 1 (accepted). Exploitation requires the attacker to be in a network MITM position, the target connection to use an IP-literal URL (e.g., https://203.0.113.10/repo.git), and the attacker to possess a valid CA-trusted certificate containing any IP SAN (not necessarily the target IP). A suggested fix patch has been published that replaces the faulty expression with matched = (addr && namelen == addrlen && memcmp(name, addr, namelen) == 0) (GitHub Advisory).

Successful exploitation allows a network attacker to bypass TLS certificate hostname verification for IP-literal HTTPS connections, enabling interception and modification of git traffic. Concrete consequences include code injection via malicious repository content, credential theft if authentication is performed over the intercepted connection, and supply chain attacks in CI/CD pipelines that use libgit2. Additionally, the inversion causes legitimate connections to IP-literal URLs with correctly configured certificates to be rejected, creating a denial-of-service condition for valid users (GitHub Advisory).

No public exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure. The CVE status remains "Reserved" and no vendor patch is available. Detection plugins have been published by Nessus (IDs: 329273, 330052, 331309, 331305, 331312, 331302, 331311) and Qualys (ID: 6567117), indicating active scanner coverage. Exploitation is constrained by the requirement for a MITM network position and a valid CA-trusted certificate with any IP SAN, which limits opportunistic exploitation (GitHub Advisory, Feedly).

1. Reconnaissance: Identify targets using libgit2 with the OpenSSL backend (Linux/Unix systems) that connect to git repositories via IP-literal HTTPS URLs (e.g., https://192.168.1.10/repo.git).
2. Obtain a valid CA-trusted certificate: Acquire or generate a certificate signed by a trusted CA that contains any IP SAN entry (the specific IP does not need to match the target).
3. Establish MITM position: Use ARP spoofing, DNS manipulation, BGP hijacking, or physical network access to intercept traffic between the libgit2 client and the target git server.
4. Present the mismatched certificate: When the libgit2 client initiates a TLS handshake to the IP-literal URL, present the attacker-controlled certificate with a mismatched IP SAN.
5. Bypass verification: Due to the inverted !!memcmp() logic, libgit2 incorrectly accepts the mismatched certificate (matched = 1), completing the TLS handshake with the attacker's server.
6. Intercept/modify traffic: Relay or modify git protocol traffic — inject malicious repository content, harvest credentials, or serve a backdoored codebase to the victim (GitHub Advisory).

• Network: TLS connections to IP-literal git URLs (e.g., https://<IP>/repo.git) where the server certificate's IP SAN does not match the destination IP; unexpected TLS certificate changes for known git server IPs.
• Logs: libgit2-based git client logs showing successful connections to IP-literal URLs with certificates that should have been rejected; absence of certificate validation errors where mismatches exist.
• Process/Application: CI/CD pipeline jobs cloning from IP-literal URLs that succeed despite certificate mismatches; unexpected repository content changes or new files introduced after a clone/fetch operation from an IP-literal remote.

No official vendor patch is available at the time of disclosure. The following mitigations are recommended:

• Avoid IP-literal URLs: Configure libgit2-based applications to use hostname-based URLs (e.g., https://git.example.com/repo.git) instead of IP-literal URLs, as DNS SAN verification is not affected by this bug.
• Apply the suggested patch: The reporter (Pavel Kohout, Aisle Research) has published a tested fix patch that corrects the !!memcmp() inversion; organizations can apply this patch and rebuild libgit2 from source.
• Use non-OpenSSL backends: On platforms where alternatives are available (macOS SecureTransport, Windows Schannel/WinHTTP, mbedTLS), these backends are not affected.
• Monitor for upstream fix: Track the libgit2 GitHub repository and GHSA-h7gc-w2gg-p9xp advisory for an official patched release (GitHub Advisory).

The vulnerability was reported by Pavel Kohout of Aisle Research and published as a GitHub Security Advisory (GHSA-h7gc-w2gg-p9xp) on July 18, 2026. OpenSUSE issued a security announcement, and multiple Fedora and Debian advisories were tracked via OSV and Linux security news outlets. Nessus and Qualys scanner plugins were rapidly published, indicating prompt uptake by the vulnerability management community (OpenSUSE Advisory, OSV).