CVE-2025-31130 vulnerabilities

Vulnerabilities for packages: starship, cargo-audit, cargo-c, helix...

gix-fs (>=0.1.0, <=0.9.1), gix-lock (>=5.0.0, <=12.0.1) +1 more potentially affected by CVE-2025-31130 via gix-features (>=0.29.0, <=0.37.2)

gix-features CARGO version =0.29.0, =0.1.0, =5.0.0, =5.0.3, =12.0.1 Source cves: CVE-2025-31130 Source advisory: OSV:GHSA-2FRX-2596-X5R6...

endringer (>=0.1.0, <=0.7.1) potentially affected by CVE-2025-31130 via gix (0.0.0)

gix CARGO version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on gix and may be impacted: - endringer =0.1.0, =0.7.1 Source cves: CVE-2025-31130 Source advisory: OSV:GHSA-2FRX-2596-X5R6...

CVE-2025-31130

gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1smol or sha1 crate, both of which implement standard SHA-1 without any mitigations...

CVE-2025-31130 gitoxide does not detect SHA-1 collision attacks

gitoxide is an implementation of git written in Rust. Before 0.42.0, gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks. gitoxide uses the sha1smol or sha1 crate, both of which implement standard SHA-1 without any mitigations...

gix-fs (>=0.1.0, <=0.9.1), gix-lock (>=5.0.0, <=12.0.1) +1 more potentially affected by CVE-2025-31130 via gix-features (>=0.29.0, <=0.37.2)

gix-features CARGO version =0.29.0, =0.1.0, =5.0.0, =5.0.3, =12.0.1 Source cves: CVE-2025-31130 Source advisory: OSV:RUSTSEC-2025-0021...