CVE-2025-21617
1 advisory.
Packagist/guzzlehttp/oauth-subscriber CVE-2025-21617: medium 6.3, EPSS 0.48%
Guzzle OAuth Subscriber has insufficient nonce entropy
Action: Upgrade guzzlehttp/oauth-subscriber to 0.8.1 or later.
composer require guzzlehttp/oauth-subscriber:0.8.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.8.1 | - |
Fixed versions
| 0.8.1 |
Sources
- osv: GHSA-237r-r8m4-4q88
- nvd: CVE-2025-21617
- https://github.com/guzzle/oauth-subscriber/security/advisories/GHSA-237r-r8m4-4q88
- https://github.com/guzzle/oauth-subscriber/commit/92b619b03bd21396e51c62e6bce83467d2ce8f53
- https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/oauth-subscriber/CVE-2025-21617.yaml
- https://github.com/guzzle/oauth-subscriber
- https://github.com/guzzle/oauth-subscriber/blob/0.8.0/src/Oauth1.php#L192
- https://github.com/guzzle/oauth-subscriber/releases/tag/0.8.1
CVE-2025-21617 · published · modified · JSON