What’s Vulnerable › Vulnerabilities

CVE-2025-53539: ReDoS in fastapi-guard's penetration attempts detector

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-07-07 · updated 2026-06-17
• Weakness: CWE-1333

Description

FastAPI Guard is a security library for FastAPI that provides middleware to control IPs, log requests, and detect penetration attempts. fastapi-guard's penetration attempts detection uses regex to scan incoming requests. However, some of the regex patterns used in detection are extremely inefficient and can cause polynomial complexity backtracks when handling specially crafted inputs. This vulnerability is fixed in 3.0.1.

Affected products

• rennf93 fastapi-guard: before 3.0.1 — fixed in 3.0.1

How to fix

Upgrade to a fixed version: rennf93 fastapi-guard 3.0.1. Check the vendor advisory for mitigations.

References

• https://github.com/rennf93/fastapi-guard/commit/d9d50e8130b7b434cdc1b001b8cfd03a06729f7f
• https://github.com/rennf93/fastapi-guard/security/advisories/GHSA-j47q-rc62-w448

Get alerted when CVE-2025-53539 or the next vulnerability affects your stack