GHSA-rrf6-pxg8-684g

Source

https://github.com/advisories/GHSA-rrf6-pxg8-684g

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-rrf6-pxg8-684g/GHSA-rrf6-pxg8-684g.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rrf6-pxg8-684g

Aliases

Published

2025-07-23T15:31:12Z

Modified

2026-09-10T03:50:26Z

Severity

7.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

FastAPI Guard has a regex bypass

Details

Summary

The regular expression patched to mitigate the ReDoS vulnerability by limiting the length of string fails to catch inputs that exceed this limit.

Details

In version 3.0.1, you can find a commit like the one in the link below, which was made to prevent ReDoS. https://github.com/rennf93/fastapi-guard/commit/d9d50e8130b7b434cdc1b001b8cfd03a06729f7f

This commit mitigates the vulnerability by limiting the length of the input string, as shown in the example below. r"<script[^>]*>[^<]*<\\/script\\s*>" -> <script[^>]{0,100}>[^<]{0,1000}<\\/script\\s{0,10}>

This type of patch fails to catch cases where the string representing the attributes of a

Database specific

{
    "cwe_ids": [
        "CWE-1333",
        "CWE-185",
        "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-23T15:31:12Z",
    "nvd_published_at": "2025-07-23T23:15:24Z",
    "severity": "HIGH"
}

References

Affected packages

PyPI / fastapi-guard

Package

Name: fastapi-guard; View open source insights on deps.dev
Purl: pkg:pypi/fastapi-guard

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.0.1

Fixed

3.0.2

Affected versions

3.*

3.0.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-rrf6-pxg8-684g/GHSA-rrf6-pxg8-684g.json"