Skip to content
fr Sign in
6.8 Medium

CVE-2025-31130 gitoxide is an implementation of git written in Rust

Description

gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide. This vulnerability is fixed in 0.42.0.

Affected products and versions

Product Affected versions Fixed in
gitoxide 0.42 earliest → < 0.42.0 0.42.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of gitoxide

The 16 CVEs of gitoxide →
CVE-2026-100419 gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that… 7.3 High CVE-2026-91986 gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing… 5.3 Medium CVE-2025-24890 gitoxide is an implementation of git written in Rust 6.8 Medium CVE-2026-82255 gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where… 7.6 High
Track this CVE