Skip to content
OpenAdvisories
Medium USN-8907-1 1 CVE

libgit2 vulnerability

Published Oct 8, 2026 · Updated Oct 9, 2026

Ecosystem: Ubuntu

Summary

It was discovered that libgit2 incorrectly handled IP address
SubjectAltName verification in TLS certificate validation. A remote
attacker with a CA-trusted certificate could possibly use this issue
to perform a machine-in-the-middle attack, leading to the exposure
of sensitive information.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 24.04 LTS 24.04:LTS libgit2 1.7.2+ds-1ubuntu3.3
Ubuntu · 26.04 LTS 26.04:LTS libgit2 1.9.1+ds-1ubuntu1.3

Vulnerabilities 1

  • Medium 6.5
    CVE-2026-53583

    libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend

    libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an in…

    libgit2 libgit2 libgit2 libgit2 Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2026-53583