CVE-2025-21617

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-21617
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21617.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-21617
Aliases
Published
2025-01-06T19:23:23.232Z
Modified
2025-12-02T02:34:08.376743Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Guzzle OAuth Subscriber has insufficient nonce entropy
Details

Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1.

Database specific 
{
    "cwe_ids": [
        "CWE-338"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/21xxx/CVE-2025-21617.json"
}
References

Affected packages

Git / github.com/guzzle/oauth-subscriber

Affected ranges

Type
GIT
Repo
https://github.com/guzzle/oauth-subscriber
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
92b619b03bd21396e51c62e6bce83467d2ce8f53

Affected versions

0.*

0.1.0
0.1.1
0.1.2
0.2.0
0.3.0
0.4.0
0.5.0
0.6.0
0.7.0
0.8.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-21617.json"