Read the docs
TI-2025-22391 Aliases CVE-2025-31130GHSA-2frx-2596-x5r6

gitoxide does not detect SHA-1 collision attacks

Priority MEDIUM 63CWE-328Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide. This vulnerability is fixed in 0.42.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00261 18th percentileScored 2026-11-07
Fix Fixed gitoxide (GitoxideLabs): 0.42.0gix-features (crates.io): 0.41.0+26 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GitoxideLabsgitoxidebefore 0.42.00.42.0Patch availableCNA
—gix-features (crates.io)before 0.41.00.41.0Patch availableGHSA-2frx-2596-x5r6
—gix-commitgraph (crates.io)before 0.27.00.27.0Patch availableGHSA-2frx-2596-x5r6
—gix-index (crates.io)before 0.39.00.39.0Patch availableGHSA-2frx-2596-x5r6
—gix-object (crates.io)before 0.48.00.48.0Patch availableGHSA-2frx-2596-x5r6
—gix-odb (crates.io)before 0.68.00.68.0Patch availableGHSA-2frx-2596-x5r6
—gix-pack (crates.io)before 0.58.00.58.0Patch availableGHSA-2frx-2596-x5r6
—gitoxide (crates.io)before 0.42.00.42.0Patch availableGHSA-2frx-2596-x5r6
—gitoxide-core (crates.io)before 0.46.00.46.0Patch availableGHSA-2frx-2596-x5r6
—gix (crates.io)before 0.71.00.71.0Patch availableGHSA-2frx-2596-x5r6
—gix-archive (crates.io)before 0.20.00.20.0Patch availableGHSA-2frx-2596-x5r6
—gix-blame (crates.io)before 0.1.00.1.0Patch availableGHSA-2frx-2596-x5r6
—gix-config (crates.io)before 0.44.00.44.0Patch availableGHSA-2frx-2596-x5r6
—gix-diff (crates.io)before 0.51.00.51.0Patch availableGHSA-2frx-2596-x5r6
—gix-dir (crates.io)before 0.13.00.13.0Patch availableGHSA-2frx-2596-x5r6
—gix-discover (crates.io)before 0.39.00.39.0Patch availableGHSA-2frx-2596-x5r6
—gix-filter (crates.io)before 0.18.00.18.0Patch availableGHSA-2frx-2596-x5r6
—gix-fsck (crates.io)before 0.10.00.10.0Patch availableGHSA-2frx-2596-x5r6
—gix-merge (crates.io)before 0.4.00.4.0Patch availableGHSA-2frx-2596-x5r6
—gix-negotiate (crates.io)before 0.19.00.19.0Patch availableGHSA-2frx-2596-x5r6
—gix-protocol (crates.io)before 0.49.00.49.0Patch availableGHSA-2frx-2596-x5r6
—gix-ref (crates.io)before 0.51.00.51.0Patch availableGHSA-2frx-2596-x5r6
—gix-revision (crates.io)before 0.33.00.33.0Patch availableGHSA-2frx-2596-x5r6
—gix-revwalk (crates.io)before 0.19.00.19.0Patch availableGHSA-2frx-2596-x5r6
—gix-status (crates.io)before 0.18.00.18.0Patch availableGHSA-2frx-2596-x5r6
—gix-traverse (crates.io)before 0.45.00.45.0Patch availableGHSA-2frx-2596-x5r6
—gix-worktree (crates.io)before 0.40.00.40.0Patch availableGHSA-2frx-2596-x5r6
—gix-worktree-state (crates.io)before 0.18.00.18.0Patch availableGHSA-2frx-2596-x5r6
  • gitoxide VendorGitoxideLabs Affected before 0.42.0 Fixed in 0.42.0 Patch available CNA
  • gix-features (crates.io) Vendor— Affected before 0.41.0 Fixed in 0.41.0 Patch available GHSA-2frx-2596-x5r6
  • gix-commitgraph (crates.io) Vendor— Affected before 0.27.0 Fixed in 0.27.0 Patch available GHSA-2frx-2596-x5r6
  • gix-index (crates.io) Vendor— Affected before 0.39.0 Fixed in 0.39.0 Patch available GHSA-2frx-2596-x5r6
  • gix-object (crates.io) Vendor— Affected before 0.48.0 Fixed in 0.48.0 Patch available GHSA-2frx-2596-x5r6
  • gix-odb (crates.io) Vendor— Affected before 0.68.0 Fixed in 0.68.0 Patch available GHSA-2frx-2596-x5r6
  • gix-pack (crates.io) Vendor— Affected before 0.58.0 Fixed in 0.58.0 Patch available GHSA-2frx-2596-x5r6
  • gitoxide (crates.io) Vendor— Affected before 0.42.0 Fixed in 0.42.0 Patch available GHSA-2frx-2596-x5r6
  • gitoxide-core (crates.io) Vendor— Affected before 0.46.0 Fixed in 0.46.0 Patch available GHSA-2frx-2596-x5r6
  • gix (crates.io) Vendor— Affected before 0.71.0 Fixed in 0.71.0 Patch available GHSA-2frx-2596-x5r6
  • gix-archive (crates.io) Vendor— Affected before 0.20.0 Fixed in 0.20.0 Patch available GHSA-2frx-2596-x5r6
  • gix-blame (crates.io) Vendor— Affected before 0.1.0 Fixed in 0.1.0 Patch available GHSA-2frx-2596-x5r6
  • gix-config (crates.io) Vendor— Affected before 0.44.0 Fixed in 0.44.0 Patch available GHSA-2frx-2596-x5r6
  • gix-diff (crates.io) Vendor— Affected before 0.51.0 Fixed in 0.51.0 Patch available GHSA-2frx-2596-x5r6
  • gix-dir (crates.io) Vendor— Affected before 0.13.0 Fixed in 0.13.0 Patch available GHSA-2frx-2596-x5r6
  • gix-discover (crates.io) Vendor— Affected before 0.39.0 Fixed in 0.39.0 Patch available GHSA-2frx-2596-x5r6
  • gix-filter (crates.io) Vendor— Affected before 0.18.0 Fixed in 0.18.0 Patch available GHSA-2frx-2596-x5r6
  • gix-fsck (crates.io) Vendor— Affected before 0.10.0 Fixed in 0.10.0 Patch available GHSA-2frx-2596-x5r6
  • gix-merge (crates.io) Vendor— Affected before 0.4.0 Fixed in 0.4.0 Patch available GHSA-2frx-2596-x5r6
  • gix-negotiate (crates.io) Vendor— Affected before 0.19.0 Fixed in 0.19.0 Patch available GHSA-2frx-2596-x5r6
  • gix-protocol (crates.io) Vendor— Affected before 0.49.0 Fixed in 0.49.0 Patch available GHSA-2frx-2596-x5r6
  • gix-ref (crates.io) Vendor— Affected before 0.51.0 Fixed in 0.51.0 Patch available GHSA-2frx-2596-x5r6
  • gix-revision (crates.io) Vendor— Affected before 0.33.0 Fixed in 0.33.0 Patch available GHSA-2frx-2596-x5r6
  • gix-revwalk (crates.io) Vendor— Affected before 0.19.0 Fixed in 0.19.0 Patch available GHSA-2frx-2596-x5r6
  • gix-status (crates.io) Vendor— Affected before 0.18.0 Fixed in 0.18.0 Patch available GHSA-2frx-2596-x5r6
  • gix-traverse (crates.io) Vendor— Affected before 0.45.0 Fixed in 0.45.0 Patch available GHSA-2frx-2596-x5r6
  • gix-worktree (crates.io) Vendor— Affected before 0.40.0 Fixed in 0.40.0 Patch available GHSA-2frx-2596-x5r6
  • gix-worktree-state (crates.io) Vendor— Affected before 0.18.0 Fixed in 0.18.0 Patch available GHSA-2frx-2596-x5r6

Remediation

  • Fix · CNA gitoxide (GitoxideLabs) Fixed in 0.42.0
  • Fix · GHSA-2frx-2596-x5r6 gix-features (crates.io) Fixed in 0.41.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-commitgraph (crates.io) Fixed in 0.27.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-index (crates.io) Fixed in 0.39.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-object (crates.io) Fixed in 0.48.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-odb (crates.io) Fixed in 0.68.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-pack (crates.io) Fixed in 0.58.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gitoxide (crates.io) Fixed in 0.42.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gitoxide-core (crates.io) Fixed in 0.46.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix (crates.io) Fixed in 0.71.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-archive (crates.io) Fixed in 0.20.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-blame (crates.io) Fixed in 0.1.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-config (crates.io) Fixed in 0.44.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-diff (crates.io) Fixed in 0.51.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-dir (crates.io) Fixed in 0.13.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-discover (crates.io) Fixed in 0.39.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-filter (crates.io) Fixed in 0.18.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-fsck (crates.io) Fixed in 0.10.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-merge (crates.io) Fixed in 0.4.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-negotiate (crates.io) Fixed in 0.19.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-protocol (crates.io) Fixed in 0.49.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-ref (crates.io) Fixed in 0.51.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-revision (crates.io) Fixed in 0.33.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-revwalk (crates.io) Fixed in 0.19.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-status (crates.io) Fixed in 0.18.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-traverse (crates.io) Fixed in 0.45.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-worktree (crates.io) Fixed in 0.40.0 Advisory →
  • Fix · GHSA-2frx-2596-x5r6 gix-worktree-state (crates.io) Fixed in 0.18.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-31130
  2. 2026-10-03 Alias added: GHSA-2frx-2596-x5r6

References

Advisory 1

Other 4

  • TI-2026-56719 gitoxide before 0.69.0 Denial of Service via gix-pack CVSS 4.0HIGH 8.7
  • TI-2026-56718 gitoxide before 0.82.0 Path Traversal via Submodule Name Validation Bypass CVSS 4.0HIGH 8.7
  • TI-2026-56717 gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules CVSS 4.0HIGH 8.7
  • TI-2026-56716 gitoxide before 0.52.1 Path Traversal via Submodule Name CVSS 4.0HIGH 8.7
  • TI-2026-56712 gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing CVSS 4.0HIGH 8.7
  • TI-2026-32410 gitoxide: Symlink prefix-reuse allows worktree escape during checkout CVSS 3.1HIGH 7.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences