Vulnerability in Fastapi-Guard Fastapi Guard
CVE-2025-53539
FastAPI Guard is a security library for FastAPI that provides middleware to control IPs, log requests, and detect penetration attempts. fastapi-guard's penetration attempts detection uses regex to scan incoming requests. However, some of the regex patterns used in detection are extremely inefficient and can cause polynomial complexity backtracks when handling specially crafted inputs. This vulnerability is fixed in 3.0.1.
Vulnerability class: ReDoS (Regular Expression Denial of Service)
EPSS: 0.004 (34.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Fastapi-guard Fastapi_guard
- Rennf93 Fastapi-guard — versions < 3.0.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-53539?
- CVE-2025-53539 is a high-severity vulnerability in Fastapi-Guard Fastapi Guard, classified under Inefficient Regular Expression Complexity. CVSS score: 7.5/10. Published 2025-07-07.
- How severe is CVE-2025-53539?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2025-53539 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.