Guzzle OAuth Subscriber has insufficient nonce entropy
Priority LOW 29CWE-338Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00479 41st percentileScored 2026-11-07
Fix Fixed oauth-subscriber (guzzle): 0.8.1guzzlehttp/oauth-subscriber (Packagist): 0.8.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| guzzle | oauth-subscriber | before 0.8.1 | 0.8.1 | Patch available | CNA |
| — | guzzlehttp/oauth-subscriber (Packagist) | before 0.8.1 | 0.8.1 | Patch available | GHSA-237r-r8m4-4q88 |
- oauth-subscriber Vendorguzzle Affected before 0.8.1 Fixed in 0.8.1 Patch available CNA
- guzzlehttp/oauth-subscriber (Packagist) Vendor— Affected before 0.8.1 Fixed in 0.8.1 Patch available GHSA-237r-r8m4-4q88
Remediation
- Fix · CNA oauth-subscriber (guzzle) Fixed in 0.8.1
- Fix · GHSA-237r-r8m4-4q88 guzzlehttp/oauth-subscriber (Packagist) Fixed in 0.8.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-21617
- 2026-10-03 Alias added: GHSA-237r-r8m4-4q88
References
Other 6
- https://github.com/guzzle/oauth-subscriber/security/advisories/GHSA-237r-r8m4-4q88
- https://github.com/guzzle/oauth-subscriber/commit/92b619b03bd21396e51c62e6bce83467d2ce8f53
- https://github.com/guzzle/oauth-subscriber/blob/0.8.0/src/Oauth1.php#L192
- https://github.com/guzzle/oauth-subscriber/releases/tag/0.8.1
- https://github.com/FriendsOfPHP/security-advisories/blob/master/guzzlehttp/oauth-subscriber/CVE-2025-21617.yaml
- https://github.com/guzzle/oauth-subscriber
More guzzle vulnerabilities
- TI-2022-08589 Improper Input Validation in guzzlehttp/psr7 CVSS 3.1HIGH 7.5
- TI-2022-13088 Fix failure to strip Authorization header on HTTP downgrade in Guzzle CVSS 3.1HIGH 7.5
- TI-2022-13087 Failure to strip the Cookie header on change in host or HTTP downgrade in Guzzle CVSS 3.1HIGH 7.5
- TI-2023-13898 Laminas Diactoros vulnerable to HTTP Multiline Header Termination CVSS 3.1HIGH 7.5
- TI-2022-11789 Cross-domain cookie leakage in Guzzle CVSS 3.1HIGH 8.1
- TI-2026-48585 Guzzle: Noncanonical host can bypass host-based checks CVSS 3.1HIGH 7.2
Sources
- CVE-2025-21617 · CVE Program
- CVE-2025-21617 · NVD
- FIRST EPSS
- GHSA-237r-r8m4-4q88 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences