CVE-2025-31130

Summary

CVE-2025-31130 is a vulnerability affecting gitoxide, an implementation of Git written in Rust, before version 0.42.0. The issue lies in the use of SHA-1 hash implementations without collision detection, making it susceptible to hash collision attacks. Both sha1_smol and sha1 crates, which gitoxide employs, implement standard SHA-1 without any safeguards against collision attacks. Consequently, two separate Git objects with matching SHA-1 hashes can disrupt Git object model integrity and bypass integrity checks in gitoxide. Version 0.42.0 of gitoxide includes the necessary fix for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.