# CVE-2025-31130: RUSTSEC-2025-0021 - SHA-1 collision attacks are not detected Source: https://junglewise.ai/threats/cve-2025-31130-gitoxide-does-not-detect-sha-1-collision-attacks Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2025-04-03 License: CC BY 4.0 with a link back CVE-2025-31130 · Severity: low · CVSS 3.1 · Published 2025-04-03 SHA-1 collision attacks are not detected Technologies: [gitoxide (crates.io)](https://junglewise.ai/threats/technologies/crates-io-gitoxide), [gitoxide-core (crates.io)](https://junglewise.ai/threats/technologies/gitoxide-core), [gix (crates.io)](https://junglewise.ai/threats/technologies/gix), [gix-index (crates.io)](https://junglewise.ai/threats/technologies/gix-index), [gix-worktree (crates.io)](https://junglewise.ai/threats/technologies/crates-io-gix-worktree), [gix-worktree-state (crates.io)](https://junglewise.ai/threats/technologies/crates-io-gix-worktree-state). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io). ## Quick answers **Is CVE-2025-31130 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-31130 being exploited in the wild. **How severe is CVE-2025-31130?** Low severity, with a CVSS score of 3.1, published 3 April 2025. **Which products and versions are affected?** gitoxide (crates.io) SEMVER:introduced=0,fixed=0.42.0; gitoxide-core (crates.io) SEMVER:introduced=0,fixed=0.46.0; gix (crates.io) SEMVER:introduced=0,fixed=0.71.0; gix-archive (crates.io) SEMVER:introduced=0,fixed=0.20.0; and 23 more. **Is there a fix for CVE-2025-31130?** Yes. gitoxide (crates.io): upgrade to 0.42.0 or later; gitoxide-core (crates.io): upgrade to 0.46.0 or later; gix (crates.io): upgrade to 0.71.0 or later; gix-archive (crates.io): upgrade to 0.20.0 or later; gix-blame (crates.io): upgrade to 0.1.0 or later; gix-commitgraph (crates.io): upgrade to 0.27.0 or later; gix-config (crates.io): upgrade to 0.44.0 or later; gix-diff (crates.io): upgrade to 0.51.0 or later; gix-dir (crates.io): upgrade to 0.13.0 or later; gix-discover (crates.io): upgrade to 0.39.0 or later; gix-features (crates.io): upgrade to 0.41.0 or later; gix-filter (crates.io): upgrade to 0.18.0 or later; gix-fsck (crates.io): upgrade to 0.10.0 or later; gix-index (crates.io): upgrade to 0.39.0 or later; gix-merge (crates.io): upgrade to 0.4.0 or later; gix-negotiate (crates.io): upgrade to 0.19.0 or later; gix-object (crates.io): upgrade to 0.48.0 or later; gix-odb (crates.io): upgrade to 0.68.0 or later; gix-pack (crates.io): upgrade to 0.58.0 or later; gix-protocol (crates.io): upgrade to 0.49.0 or later; gix-ref (crates.io): upgrade to 0.51.0 or later; gix-revision (crates.io): upgrade to 0.33.0 or later; gix-revwalk (crates.io): upgrade to 0.19.0 or later; gix-status (crates.io): upgrade to 0.18.0 or later; gix-traverse (crates.io): upgrade to 0.45.0 or later; gix-worktree (crates.io): upgrade to 0.40.0 or later; gix-worktree-state (crates.io): upgrade to 0.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **Am I affected by CVE-2025-31130?** Check whether you run gitoxide (crates.io), gitoxide-core (crates.io), gix (crates.io) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - gitoxide (crates.io): upgrade to 0.42.0 or later ```sh cargo update -p gitoxide ``` - gitoxide-core (crates.io): upgrade to 0.46.0 or later ```sh cargo update -p gitoxide-core ``` - gix (crates.io): upgrade to 0.71.0 or later ```sh cargo update -p gix ``` - gix-archive (crates.io): upgrade to 0.20.0 or later ```sh cargo update -p gix-archive ``` - gix-blame (crates.io): upgrade to 0.1.0 or later ```sh cargo update -p gix-blame ``` - gix-commitgraph (crates.io): upgrade to 0.27.0 or later ```sh cargo update -p gix-commitgraph ``` - gix-config (crates.io): upgrade to 0.44.0 or later ```sh cargo update -p gix-config ``` - gix-diff (crates.io): upgrade to 0.51.0 or later ```sh cargo update -p gix-diff ``` - gix-dir (crates.io): upgrade to 0.13.0 or later ```sh cargo update -p gix-dir ``` - gix-discover (crates.io): upgrade to 0.39.0 or later ```sh cargo update -p gix-discover ``` - gix-features (crates.io): upgrade to 0.41.0 or later ```sh cargo update -p gix-features ``` - gix-filter (crates.io): upgrade to 0.18.0 or later ```sh cargo update -p gix-filter ``` - gix-fsck (crates.io): upgrade to 0.10.0 or later ```sh cargo update -p gix-fsck ``` - gix-index (crates.io): upgrade to 0.39.0 or later ```sh cargo update -p gix-index ``` - gix-merge (crates.io): upgrade to 0.4.0 or later ```sh cargo update -p gix-merge ``` - gix-negotiate (crates.io): upgrade to 0.19.0 or later ```sh cargo update -p gix-negotiate ``` - gix-object (crates.io): upgrade to 0.48.0 or later ```sh cargo update -p gix-object ``` - gix-odb (crates.io): upgrade to 0.68.0 or later ```sh cargo update -p gix-odb ``` - gix-pack (crates.io): upgrade to 0.58.0 or later ```sh cargo update -p gix-pack ``` - gix-protocol (crates.io): upgrade to 0.49.0 or later ```sh cargo update -p gix-protocol ``` - gix-ref (crates.io): upgrade to 0.51.0 or later ```sh cargo update -p gix-ref ``` - gix-revision (crates.io): upgrade to 0.33.0 or later ```sh cargo update -p gix-revision ``` - gix-revwalk (crates.io): upgrade to 0.19.0 or later ```sh cargo update -p gix-revwalk ``` - gix-status (crates.io): upgrade to 0.18.0 or later ```sh cargo update -p gix-status ``` - gix-traverse (crates.io): upgrade to 0.45.0 or later ```sh cargo update -p gix-traverse ``` - gix-worktree (crates.io): upgrade to 0.40.0 or later ```sh cargo update -p gix-worktree ``` - gix-worktree-state (crates.io): upgrade to 0.18.0 or later ```sh cargo update -p gix-worktree-state ``` ## Affected products - gitoxide (crates.io) SEMVER:introduced=0,fixed=0.42.0 - gitoxide-core (crates.io) SEMVER:introduced=0,fixed=0.46.0 - gix (crates.io) SEMVER:introduced=0,fixed=0.71.0 - gix-archive (crates.io) SEMVER:introduced=0,fixed=0.20.0 - gix-blame (crates.io) SEMVER:introduced=0,fixed=0.1.0 - gix-commitgraph (crates.io) SEMVER:introduced=0,fixed=0.27.0 - gix-config (crates.io) SEMVER:introduced=0,fixed=0.44.0 - gix-diff (crates.io) SEMVER:introduced=0,fixed=0.51.0 - gix-dir (crates.io) SEMVER:introduced=0,fixed=0.13.0 - gix-discover (crates.io) SEMVER:introduced=0,fixed=0.39.0 - gix-features (crates.io) SEMVER:introduced=0,fixed=0.41.0, SEMVER:introduced=0.0.0-0,fixed=0.41.0 - gix-filter (crates.io) SEMVER:introduced=0,fixed=0.18.0 - gix-fsck (crates.io) SEMVER:introduced=0,fixed=0.10.0 - gix-index (crates.io) SEMVER:introduced=0,fixed=0.39.0 - gix-merge (crates.io) SEMVER:introduced=0,fixed=0.4.0 - gix-negotiate (crates.io) SEMVER:introduced=0,fixed=0.19.0 - gix-object (crates.io) SEMVER:introduced=0,fixed=0.48.0 - gix-odb (crates.io) SEMVER:introduced=0,fixed=0.68.0 - gix-pack (crates.io) SEMVER:introduced=0,fixed=0.58.0 - gix-protocol (crates.io) SEMVER:introduced=0,fixed=0.49.0 - gix-ref (crates.io) SEMVER:introduced=0,fixed=0.51.0 - gix-revision (crates.io) SEMVER:introduced=0,fixed=0.33.0 - gix-revwalk (crates.io) SEMVER:introduced=0,fixed=0.19.0 - gix-status (crates.io) SEMVER:introduced=0,fixed=0.18.0 - gix-traverse (crates.io) SEMVER:introduced=0,fixed=0.45.0 - gix-worktree (crates.io) SEMVER:introduced=0,fixed=0.40.0 - gix-worktree-state (crates.io) SEMVER:introduced=0,fixed=0.18.0 ## Identifiers - CVE-2025-31130 - GHSA-2frx-2596-x5r6 - RUSTSEC-2025-0021 ## Related threats - [gitoxide gix path-protection bypass via untrusted .git/config](https://junglewise.ai/threats/gitoxide-gix-untrusted-git-config-disables-filesystem-git-protection-1eddd4d0) - [gitoxide gix-pack denial of service via unchecked indexing and uncapped allocation](https://junglewise.ai/threats/cve-2026-82254-gitoxide-gix-pack-denial-of-service-via-unchecked-indexing-and) - [gitoxide path traversal in submodule name validation](https://junglewise.ai/threats/cve-2026-82253-gitoxide-path-traversal-in-submodule-name-validation) - [gitoxide symlink following in .gitmodules file](https://junglewise.ai/threats/cve-2026-82252-gitoxide-symlink-following-in-gitmodules-file) - [gitoxide path traversal in submodule name resolution](https://junglewise.ai/threats/cve-2026-82251-gitoxide-path-traversal-in-submodule-name-resolution)