CVE-2025-21617

Medium

Advisory

Published 6 Jan 2025In the index since 6 Sept 2026

Guzzle OAuth Subscriber has insufficient nonce entropy

Carried by container images the latest versions of 2 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
guzzlehttp/oauth-subscribercomposer	0.6.0	0.8.1	2

2 by stars

Chart

Latest

Affected images

Radar Score

mauticone-acre-fund

1 of the 3 container images this version deploys carry CVE-2025-21617.

Container image	Digest	Package	Fixed in
mautic/mautic :v4-apache	94ea4acf4049	guzzlehttp/oauth-subscriber@0.6.0	0.8.1

2,667

leantimegissilabs

1 of the 2 container images this version deploys carry CVE-2025-21617.

Container image	Digest	Package	Fixed in
leantime/leantime :3.3.3	ad4bfb0699d3	guzzlehttp/oauth-subscriber@0.6.0	0.8.1

6,416

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
leantime/leantime :3.3.3	ad4bfb0699d3	guzzlehttp/oauth-subscriber@0.6.0	0.8.1	1
mautic/mautic :v4-apache	94ea4acf4049	guzzlehttp/oauth-subscriber@0.6.0	0.8.1	1