PYSEC-2026-1360
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/fastapi-guard/PYSEC-2026-1360.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-1360
- Aliases
- Published
- 2026-07-07T16:02:58Z
- Modified
- 2026-07-07T17:47:35Z
- Severity
-
- 7.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
- Summary
- FastAPI Guard has a regex bypass
- Details
-
Summary
The regular expression patched to mitigate the ReDoS vulnerability by limiting the length of string fails to catch inputs that exceed this limit.
Details
In version 3.0.1, you can find a commit like the one in the link below, which was made to prevent ReDoS. https://github.com/rennf93/fastapi-guard/commit/d9d50e8130b7b434cdc1b001b8cfd03a06729f7f
This commit mitigates the vulnerability by limiting the length of the input string, as shown in the example below.
r"<script[^>]*>[^<]*<\\/script\\s*>"-><script[^>]{0,100}>[^<]{0,1000}<\\/script\\s{0,10}>This type of patch fails to catch cases where the string representing the attributes of a
- References
-
- https://github.com/rennf93/fastapi-guard/security/advisories/GHSA-rrf6-pxg8-684g
- https://nvd.nist.gov/vuln/detail/CVE-2025-54365
- https://github.com/rennf93/fastapi-guard/commit/0829292c322d33dc14ab00c5451c5c138148035a
- https://github.com/rennf93/fastapi-guard/commit/d9d50e8130b7b434cdc1b001b8cfd03a06729f7f
- https://github.com/rennf93/fastapi-guard
- https://pypi.org/project/fastapi-guard
- https://github.com/advisories/GHSA-rrf6-pxg8-684g
Affected packages
PyPI / fastapi-guard
Package
- Name
- fastapi-guard
- View open source insights on deps.dev
- Purl
- pkg:pypi/fastapi-guard