CVE-2025-31130: gitoxidelabs gitoxide Use of Weak Hash

Vulnerability summary

CVE-2025-31130 is a medium (CVSS 6.8) Use of Weak Hash vulnerability in gitoxidelabs gitoxide. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.1% of scored vulnerabilities.

Timeline

1. 04-04-2025
   PublishedVulnerability first disclosed.
2. 23-01-2026
   Last modifiedVulnerability information updated.

Description

gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide. This vulnerability is fixed in 0.42.0.

• CWE-328Use of Weak HashThe product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).