CVE-2025-31130 gitoxide does not detect SHA-1 collision attacks

What is CVE-2025-31130?

CVE-2025-31130 is a medium-severity vulnerability in GitoxideLabs gitoxide, published on 4 Apr 2025.

Official description

gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide. This vulnerability is fixed in 0.42.0.

Weakness: CWE-328

Which versions are affected by CVE-2025-31130?

40 open source packages ship an affected version, including gitoxide, gitoxide-core and gix.

How do I fix CVE-2025-31130?

Upgrade gitoxide to 0.42.0 or later.

Is CVE-2025-31130 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-31130 exists.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2025-31130, GHSA-2frx-2596-x5r6, MINI-wj8m-7cjc-fx46, RUSTSEC-2025-0021, UBUNTU-CVE-2025-31130.