Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

The vulnerability identified as CVE-2026-53583 affects libgit2 versions prior to 1.8.6 and 1.9.5. It involves incorrect validation of IP-literal HTTPS URLs when using OpenSSL as the TLS backend. This validation flaw allows a network attacker who possesses a CA-trusted certificate with any IP SubjectAltName to intercept TLS connections, effectively undermining the security of the connection. The flaw does not affect DNS SubjectAltName validation or other TLS backends besides OpenSSL. Red Hat has issued a security advisory and released updated libgit2 packages (version 1.9.7-1.hum1) to fix this vulnerability.

The vulnerability enables a network attacker with a CA-trusted certificate containing any IP SubjectAltName to intercept HTTPS connections that rely on libgit2 with OpenSSL. This compromises the confidentiality and integrity of the affected connections. The issue is limited to OpenSSL builds and does not affect other TLS backends or DNS-based validation. The CVSS score is 6.5, indicating medium severity.

Red Hat has released updated libgit2 packages (version 1.9.7-1.hum1) that fix this vulnerability. Users should apply the update to their Red Hat Hardened Images RPMs to remediate the issue. No other mitigation steps are indicated or required by the vendor advisory.