CVE-2025-21617— Guzzle OAuth Subscriber has insufficient nonce entropy
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-21617
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Guzzle OAuth Subscriber has insufficient nonce entropy
Source: NVD (National Vulnerability Database)
Vulnerability Description
Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用具有密码学弱点缺陷的PRNG
Source: NVD (National Vulnerability Database)
Vulnerability Title
Guzzle 安全特征问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Guzzle是guzzlehttp个人开发者的一个 PHP HTTP 客户端，可以轻松发送 HTTP 请求并轻松与 Web 服务集成。 Guzzle 0.8.1之前版本存在安全特征问题漏洞，该漏洞源于Nonce生成未使用足够的熵或加密安全的伪随机源。当未使用TLS时，可能导致服务器容易受到重放攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| guzzle | oauth-subscriber | < 0.8.1 | - |
II. Public POCs for CVE-2025-21617
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-21617
请登录查看更多情报信息。
- Release 0.8.1 · guzzle/oauth-subscriber · GitHubx_refsource_MISC
- Insufficient nonce entropy · Advisory · guzzle/oauth-subscriber · GitHubx_refsource_CONFIRM
- Release 0.8.1 · guzzle/oauth-subscriber@92b619b · GitHubx_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2025-21617
IV. Related Vulnerabilities
Same vendor: guzzle
- CVE-2023-29197
Improper header name validation in guzzlehttp/psr7 - CVE-2022-31090
CURLOPT_HTTPAUTH option not cleared on change of origin in G - CVE-2022-31091
Change in port should be considered a change in origin in Gu - CVE-2022-31042
Failure to strip the Cookie header on change in host or HTTP - CVE-2022-31043
Fix failure to strip Authorization header on HTTP downgrade
Same weakness: CWE-338
- CVE-2026-6659
Crypt::PasswdMD5 versions through 1.42 for Perl generates in - CVE-2026-41505
RELATE: Predictable Token Generation in auth.py and exam.py - CVE-2026-40514
SmarterTools SmarterMail < Build 9610 Cryptographic Weakness - CVE-2026-5088
Apache::API::Password versions through 0.5.2 for Perl can ge - CVE-2026-25726
Cloudreve is vulnerable to Account Takeover via Weak Cryptog
V. Comments for CVE-2025-21617
No comments yet