{"action":"Upgrade guzzlehttp/oauth-subscriber to 0.8.1 or later.","affected":[{"fixed":"0.8.1","introduced":"0"}],"component":"guzzlehttp/oauth-subscriber","cve_ids":["CVE-2025-21617"],"ecosystem":"Packagist","epss":0.00479,"exploited":false,"fixed_versions":["0.8.1"],"ghsa_id":"GHSA-237r-r8m4-4q88","id":"tcs_01M5KERF86WKCJWYDGM8NZCA2Y","modified_at":"2026-07-15T22:00:51.159337328Z","published_at":"2025-01-06T19:23:26Z","references":["https://osv.dev/vulnerability/GHSA-237r-r8m4-4q88","https://github.com/guzzle/oauth-subscriber/security/advisories/GHSA-237r-r8m4-4q88","https://nvd.nist.gov/vuln/detail/CVE-2025-21617","https://github.com/guzzle/oauth-subscriber/commit/92b619b03bd21396e51c62e6bce83467d2ce8f53","https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/oauth-subscriber/CVE-2025-21617.yaml","https://github.com/guzzle/oauth-subscriber","https://github.com/guzzle/oauth-subscriber/blob/0.8.0/src/Oauth1.php#L192","https://github.com/guzzle/oauth-subscriber/releases/tag/0.8.1"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-237r-r8m4-4q88","url":"https://osv.dev/vulnerability/GHSA-237r-r8m4-4q88"},{"source":"nvd","source_id":"CVE-2025-21617","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-21617"}],"summary":"Guzzle OAuth Subscriber has insufficient nonce entropy"}