GHSA-2frx-2596-x5r6Published

gitoxide does not detect SHA-1 collision attacks

cve-program · CVE-2025-31130

Published

gitoxide

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "GitoxideLabs",
                    "product": "gitoxide",
                    "versions": [
                        {
                            "version": "< 0.42.0",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2025-9751

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Apr 4, 2025, 2:41:56 PM

dateUpdated: Jan 23, 2026, 5:08:57 PM

2 related source bulletins · separate from aliases

openSUSE-SU-2025:14994-1: gitoxide-0.42.0-1.1 on GA media

CVE-2025-22620 · CVE-2025-31130

openSUSE-SU-2026:21558-1: Security update for gitoxide

CVE-2024-32650 · CVE-2025-22620 · CVE-2025-31130 · CVE-2026-25541 · CVE-2026-40034

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2025-31130

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-328

Original publisher date fields

published: 2025-04-04T15:15:48.320

lastModified: 2026-06-17T09:09:54.553

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-2frx-2596-x5r6

Published

gix-features

crates.io

SEMVER · introduced 0 → fixed 0.41.0

gix-commitgraph

crates.io

SEMVER · introduced 0 → fixed 0.27.0

gix-index

crates.io

SEMVER · introduced 0 → fixed 0.39.0

gix-object

crates.io

SEMVER · introduced 0 → fixed 0.48.0

gix-odb

crates.io

SEMVER · introduced 0 → fixed 0.68.0

gix-pack

crates.io

SEMVER · introduced 0 → fixed 0.58.0

gitoxide

crates.io

SEMVER · introduced 0 → fixed 0.42.0

gitoxide-core

crates.io

SEMVER · introduced 0 → fixed 0.46.0

gix

crates.io

SEMVER · introduced 0 → fixed 0.71.0

gix-archive

crates.io

SEMVER · introduced 0 → fixed 0.20.0

gix-blame

crates.io

SEMVER · introduced 0 → fixed 0.1.0

gix-config

crates.io

SEMVER · introduced 0 → fixed 0.44.0

gix-diff

crates.io

SEMVER · introduced 0 → fixed 0.51.0

gix-dir

crates.io

SEMVER · introduced 0 → fixed 0.13.0

gix-discover

crates.io

SEMVER · introduced 0 → fixed 0.39.0

gix-filter

crates.io

SEMVER · introduced 0 → fixed 0.18.0

gix-fsck

crates.io

SEMVER · introduced 0 → fixed 0.10.0

gix-merge

crates.io

SEMVER · introduced 0 → fixed 0.4.0

gix-negotiate

crates.io

SEMVER · introduced 0 → fixed 0.19.0

gix-protocol

crates.io

SEMVER · introduced 0 → fixed 0.49.0

gix-ref

crates.io

SEMVER · introduced 0 → fixed 0.51.0

gix-revision

crates.io

SEMVER · introduced 0 → fixed 0.33.0

gix-revwalk

crates.io

SEMVER · introduced 0 → fixed 0.19.0

gix-status

crates.io

SEMVER · introduced 0 → fixed 0.18.0

gix-traverse

crates.io

SEMVER · introduced 0 → fixed 0.45.0

gix-worktree

crates.io

SEMVER · introduced 0 → fixed 0.40.0

gix-worktree-state

crates.io

SEMVER · introduced 0 → fixed 0.18.0

Original source record · Cite this exact observation · Complete original publisher JSON

osv · RUSTSEC-2025-0021

Published

gix-features

crates.io

SEMVER · introduced 0.0.0-0 → fixed 0.41.0

Original source record · Cite this exact observation · Complete original publisher JSON