CVSS 3.1
6.8 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:NCVE-2025-31130
Medium (6.8). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in gix-features 0.41.0.
gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide. This vulnerability is fixed in 0.42.0.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
- CWE
- CWE-328
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2frx-2596-x5r6 | crates.io | gix-features | <0.41.0 | 0.41.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-commitgraph | <0.27.0 | 0.27.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-index | <0.39.0 | 0.39.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-object | <0.48.0 | 0.48.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-odb | <0.68.0 | 0.68.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-pack | <0.58.0 | 0.58.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gitoxide | <0.42.0 | 0.42.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gitoxide-core | <0.46.0 | 0.46.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix | <0.71.0 | 0.71.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-archive | <0.20.0 | 0.20.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-blame | <0.1.0 | 0.1.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-config | <0.44.0 | 0.44.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-diff | <0.51.0 | 0.51.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-dir | <0.13.0 | 0.13.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-discover | <0.39.0 | 0.39.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-filter | <0.18.0 | 0.18.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-fsck | <0.10.0 | 0.10.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-merge | <0.4.0 | 0.4.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-negotiate | <0.19.0 | 0.19.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-protocol | <0.49.0 | 0.49.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-ref | <0.51.0 | 0.51.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-revision | <0.33.0 | 0.33.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-revwalk | <0.19.0 | 0.19.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-status | <0.18.0 | 0.18.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-traverse | <0.45.0 | 0.45.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-worktree | <0.40.0 | 0.40.0 |
| GHSA-2frx-2596-x5r6 | crates.io | gix-worktree-state | <0.18.0 | 0.18.0 |
| RUSTSEC-2025-0021 | crates.io | gix-features | >=0.0.0-0 <0.41.0 | 0.41.0 |