{"schemaVersion":3,"id":"CVE-2025-31130","aliases":["UBUNTU-CVE-2025-31130","DEBIAN-CVE-2025-31130","CGA-23wm-fm7j-rvwh","CGA-2gj9-8446-p664","CGA-2gmq-g25j-q4rv","CGA-2w2j-f2q2-5xmw","CGA-379j-7r8h-96mm","CGA-44wx-p48f-f3gq","CGA-47rj-8gch-87p4","CGA-5g46-j426-8h9w","CGA-6r68-4mrv-29g7","CGA-6xh4-9j34-m258","CGA-746r-rccj-mgjq","CGA-7cww-rf6j-wcgm","CGA-7cx7-gh39-4gw6","CGA-7r2w-vjjx-7cfm","CGA-8mm7-mc9x-4526","CGA-96g5-45hp-gwvg","CGA-97qg-vc29-2fmf","CGA-9xhw-73rh-rfrx","CGA-cv8f-f662-vq2w","CGA-cvxg-grgq-pfvw","CGA-f436-4rcr-8gv7","CGA-f7hp-94rr-wxmr","CGA-g7h2-xvfq-q6xq","CGA-g7m4-hwx2-3r24","CGA-g9r6-jqc4-r4jc","CGA-h7f7-35j7-8fgq","CGA-h8p9-45qx-9mvr","CGA-h9xv-9r7f-p8mf","CGA-hc75-jwgm-r42v","CGA-hpvv-wrqh-gpmp","CGA-m5f8-f6mw-53pg","CGA-p437-5p5h-h9r4","CGA-pf7j-wf5h-7vxw","CGA-pm7h-vfr7-jhq5","CGA-prmm-xcgf-hxx8","CGA-q39w-h38w-68px","CGA-r733-w55r-fq83","CGA-vj27-mh3v-x4pv","CGA-w457-h22h-pmxv","CGA-w4g8-9773-777j","CGA-w69r-f7h8-c5p9","CGA-w9gx-32q8-89hq","CGA-wwqm-452j-wc43","CGA-x358-vvgm-j78v","GHSA-2frx-2596-x5r6","RUSTSEC-2025-0021"],"status":"published","duplicateOf":null,"title":null,"description":"gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1_smol or sha1 crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide. This vulnerability is fixed in 0.42.0.","dates":{"published":"2025-04-04T14:41:56.355Z","modified":"2026-01-23T17:08:57.443Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.8,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":6.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","exploitability":5.6,"impact":6.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":6.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","exploitability":5.6,"impact":6.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":6.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","exploitability":5.6,"impact":6.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":6.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","exploitability":5.6,"impact":6.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Crates.io","score":6.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","exploitability":5.6,"impact":6.7,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00256,"percentile":0.16195,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.006000000000000016,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.0025},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00254,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00256,"percentile":0.16195}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0025,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00254,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00256,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00256,"percentile":0.16195}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-328","name":"Use of Weak Hash","description":"The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/328.html"}],"affected":[{"vendor":"chainguard","product":"cargo-audit","name":"cargo-audit","label":"cargo-audit","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cargo-audit","purlType":"apk","versions":[{"text":"< 0.22.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.22.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"cargo-c","name":"cargo-c","label":"cargo-c","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cargo-c","purlType":"apk","versions":[{"text":"< 0.10.23-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.10.23-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"helix","name":"helix","label":"helix","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/helix","purlType":"apk","versions":[{"text":"< 25.01.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.01.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"starship","name":"starship","label":"starship","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/starship","purlType":"apk","versions":[{"text":"< 1.24.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.24.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"cargo-audit","name":"cargo-audit","label":"cargo-audit","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/cargo-audit","purlType":"apk","versions":[{"text":"< 0.22.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.22.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"cargo-c","name":"cargo-c","label":"cargo-c","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/cargo-c","purlType":"apk","versions":[{"text":"< 0.10.23-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.10.23-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"helix","name":"helix","label":"helix","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/helix","purlType":"apk","versions":[{"text":"< 25.01.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 25.01.1-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"starship","name":"starship","label":"starship","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/starship","purlType":"apk","versions":[{"text":"< 1.24.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.24.0-r0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gitoxide","name":"gitoxide","label":"gitoxide","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gitoxide","purlType":"cargo","versions":[{"text":"< 0.42.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.42.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gitoxide-core","name":"gitoxide-core","label":"gitoxide-core","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gitoxide-core","purlType":"cargo","versions":[{"text":"< 0.46.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.46.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix","name":"gix","label":"gix","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix","purlType":"cargo","versions":[{"text":"< 0.71.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.71.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-archive","name":"gix-archive","label":"gix-archive","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-archive","purlType":"cargo","versions":[{"text":"< 0.20.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.20.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-blame","name":"gix-blame","label":"gix-blame","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-blame","purlType":"cargo","versions":[{"text":"< 0.1.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.1.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-commitgraph","name":"gix-commitgraph","label":"gix-commitgraph","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-commitgraph","purlType":"cargo","versions":[{"text":"< 0.27.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.27.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-config","name":"gix-config","label":"gix-config","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-config","purlType":"cargo","versions":[{"text":"< 0.44.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-diff","name":"gix-diff","label":"gix-diff","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-diff","purlType":"cargo","versions":[{"text":"< 0.51.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.51.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-dir","name":"gix-dir","label":"gix-dir","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-dir","purlType":"cargo","versions":[{"text":"< 0.13.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.13.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-discover","name":"gix-discover","label":"gix-discover","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-discover","purlType":"cargo","versions":[{"text":"< 0.39.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.39.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-features","name":"gix-features","label":"gix-features","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-features","purlType":"cargo","versions":[{"text":"< 0.41.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.0.0-0, < 0.41.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.41.0 | ≥ 0.0.0-0, < 0.41.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-filter","name":"gix-filter","label":"gix-filter","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-filter","purlType":"cargo","versions":[{"text":"< 0.18.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.18.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-fsck","name":"gix-fsck","label":"gix-fsck","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-fsck","purlType":"cargo","versions":[{"text":"< 0.10.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.10.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-index","name":"gix-index","label":"gix-index","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-index","purlType":"cargo","versions":[{"text":"< 0.39.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.39.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-merge","name":"gix-merge","label":"gix-merge","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-merge","purlType":"cargo","versions":[{"text":"< 0.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.4.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-negotiate","name":"gix-negotiate","label":"gix-negotiate","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-negotiate","purlType":"cargo","versions":[{"text":"< 0.19.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-object","name":"gix-object","label":"gix-object","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-object","purlType":"cargo","versions":[{"text":"< 0.48.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.48.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-odb","name":"gix-odb","label":"gix-odb","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-odb","purlType":"cargo","versions":[{"text":"< 0.68.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.68.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-pack","name":"gix-pack","label":"gix-pack","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-pack","purlType":"cargo","versions":[{"text":"< 0.58.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.58.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-protocol","name":"gix-protocol","label":"gix-protocol","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-protocol","purlType":"cargo","versions":[{"text":"< 0.49.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.49.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-ref","name":"gix-ref","label":"gix-ref","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-ref","purlType":"cargo","versions":[{"text":"< 0.51.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.51.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-revision","name":"gix-revision","label":"gix-revision","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-revision","purlType":"cargo","versions":[{"text":"< 0.33.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.33.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-revwalk","name":"gix-revwalk","label":"gix-revwalk","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-revwalk","purlType":"cargo","versions":[{"text":"< 0.19.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.19.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-status","name":"gix-status","label":"gix-status","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-status","purlType":"cargo","versions":[{"text":"< 0.18.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.18.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-traverse","name":"gix-traverse","label":"gix-traverse","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-traverse","purlType":"cargo","versions":[{"text":"< 0.45.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.45.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-worktree","name":"gix-worktree","label":"gix-worktree","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-worktree","purlType":"cargo","versions":[{"text":"< 0.40.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.40.0","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"gix-worktree-state","name":"gix-worktree-state","label":"gix-worktree-state","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/gix-worktree-state","purlType":"cargo","versions":[{"text":"< 0.18.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.18.0","eol":null,"hubHref":null},{"vendor":"debian","product":"rust-gix-features","name":"rust-gix-features","label":"rust-gix-features","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/rust-gix-features","purlType":"deb","versions":[{"text":"< 0.39.1-2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.39.1-2","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"rust-gix-features","name":"rust-gix-features","label":"rust-gix-features","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/rust-gix-features","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"gitoxidelabs","product":"gitoxide","name":"gitoxide","label":"gitoxide","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.42.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.42.0","eol":null,"hubHref":"/vendor/gitoxidelabs/gitoxide"}],"affectedCount":38,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2frx-2596-x5r6","label":"github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-2frx-2596-x5r6","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB"]},{"url":"https://github.com/GitoxideLabs/gitoxide/commit/f253f02a6658b3b7612a50d56c71f5ae4da4ca21","label":"github.com/GitoxideLabs/gitoxide/commit/f253f02a6658b3b7612a50d56c71f5ae4da4ca21","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB"]},{"url":"https://ubuntu.com/security/CVE-2025-31130","label":"ubuntu.com/security/CVE-2025-31130","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-31130","label":"www.cve.org/CVERecord?id=CVE-2025-31130","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0021.html","label":"rustsec.org/advisories/RUSTSEC-2025-0021.html","hostname":"rustsec.org","tags":["REPORT","WEB","Advisory"]},{"url":"https://github.com/GitoxideLabs/gitoxide/commit/4660f7a6f71873311f68f170b0f1f6659a02829d","label":"github.com/GitoxideLabs/gitoxide/commit/4660f7a6f71873311f68f170b0f1f6659a02829d","hostname":"github.com","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-31130","label":"security-tracker.debian.org/tracker/CVE-2025-31130","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31130.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31130.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31130","label":"nvd.nist.gov/vuln/detail/CVE-2025-31130","hostname":"nvd.nist.gov","tags":["Advisory","WEB"]},{"url":"https://github.com/GitoxideLabs/gitoxide","label":"github.com/GitoxideLabs/gitoxide","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://crates.io/crates/gix-features","label":"crates.io/crates/gix-features","hostname":"crates.io","tags":["PACKAGE"]},{"url":"https://github.com/advisories/GHSA-2frx-2596-x5r6","label":"github.com/advisories/GHSA-2frx-2596-x5r6","hostname":"github.com","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2025:14994-1","OPENSUSE-SU-2026:21558-1"],"duplicates":[],"related":["CGA-XPFF-JH97-9J26","OPENSUSE-SU-2025:14994-1","OPENSUSE-SU-2026:21558-1"]},"timeline":[{"kind":"published","date":"2025-04-04T14:41:56.355Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-01-23T17:08:57.443Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":27,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T05:39:29.704Z","stale":false,"partial":false}}