CVE-2025-54365
📋 TL;DR
CVE-2025-54365 is a regular expression denial-of-service (ReDoS) vulnerability in fastapi-guard version 3.0.1 where the patch limiting string length fails to properly handle <script> tag attributes exceeding 100 characters, allowing attackers to bypass security patterns. This affects FastAPI applications using fastapi-guard 3.0.1 for security middleware. Attackers could potentially bypass IP controls, logging, and penetration detection mechanisms.
💻 Affected Systems
- fastapi-guard
📦 What is this software?
Fastapi Guard by Fastapi Guard
⚠️ Risk & Real-World Impact
Worst Case
Complete bypass of fastapi-guard security controls leading to unauthorized access, successful penetration attempts, and denial-of-service through regex processing overhead.
Likely Case
Partial bypass of security patterns allowing some malicious requests to evade detection while others are still caught.
If Mitigated
Minimal impact with proper input validation and request filtering at additional layers.
🎯 Exploit Status
Exploitation requires crafting HTTP requests with specific <script> tag attributes exceeding 100 characters to trigger regex bypass.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.2
Vendor Advisory: https://github.com/rennf93/fastapi-guard/security/advisories/GHSA-rrf6-pxg8-684g
Restart Required: Yes
Instructions:
1. Update fastapi-guard: pip install fastapi-guard==3.0.2 2. Restart your FastAPI application 3. Verify the update with pip show fastapi-guard
🔧 Temporary Workarounds
Input Length Validation
allImplement additional input validation to reject requests with <script> tag attributes exceeding 100 characters
WAF Rule
allConfigure web application firewall to block requests with suspicious <script> tag patterns
🧯 If You Can't Patch
- Implement rate limiting to prevent automated exploitation attempts
- Deploy additional security layers like reverse proxies with pattern matching
🔍 How to Verify
Check if Vulnerable:
Check fastapi-guard version: pip show fastapi-guard | grep VersionCheck Version:
pip show fastapi-guard | grep VersionVerify Fix Applied:
Confirm version is 3.0.2 or higher and test with crafted requests containing long <script> attributes📡 Detection & Monitoring
Log Indicators:
- Unusual number of requests with long <script> tag attributes
- Requests bypassing expected security patterns
Network Indicators:
- HTTP requests containing <script> tags with attributes exceeding 100 characters
- Increased response times from regex processing
SIEM Query:
source="application_logs" AND ("<script" AND LENGTH(attributes) > 100) OR "bypass" AND "fastapi-guard"🔗 References
- https://github.com/rennf93/fastapi-guard/commit/0829292c322d33dc14ab00c5451c5c138148035a
- https://github.com/rennf93/fastapi-guard/commit/d9d50e8130b7b434cdc1b001b8cfd03a06729f7f
- https://github.com/rennf93/fastapi-guard/security/advisories/GHSA-rrf6-pxg8-684g
- https://github.com/rennf93/fastapi-guard/security/advisories/GHSA-rrf6-pxg8-684g
