In the libgit2 library, the function verify_server_cert incorrectly compares IP literals against certificate Subject Alternative Names when using an OpenSSL backend. The inverted comparison logic causes OpenSSL to reject matching IP addresses and accept mismatched ones, allowing an attacker to use a CA‑trusted certificate containing any IP SAN to intercept HTTPS connections that target an IP literal. The flaw is limited to IP‑based hostnames; DNS‑based URLs and non‑OpenSSL TLS backends are unaffected. The consequence is an attacker can perform a man‑in‑the‑middle interception of traffic and potentially compromise confidentiality.

Vulnerability affects libgit2 prior to the release of v1.8.6 and v1.9.5. Systems that link against these older versions and rely on the OpenSSL TLS backend for HTTPS traffic to IP literals are impacted. Any application that uses libgit2 and enables the OpenSSL backend without upgrading is at risk.

With a CVSS score of 6.5, the vulnerability is considered medium to high severity. No EPSS data is available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is a network attacker who can procure a CA‑trusted certificate containing an arbitrary IP SAN, then target a client that uses an IP literal URL over HTTPS with an OpenSSL backend. Because the flaw allows the client to accept a mismatched IP SAN, the attacker can intercept or tamper with traffic before the client trusts the certificate. Exploitation requires the attacker to be able to influence the certificate presented to the client; once that condition is met the vulnerability is straightforward to trigger.