Threats affecting pkg:brew/fastapi

A vulnerability in dnspython's dns.name.from_wire_parser() function can cause excessive CPU usage when processing maliciously crafted DNS messages. This can degrade or deny service to applications using dnspython for DNS name decompression. The issue affects FastAPI versions from 0.111.0 up to but not including 0.143.1. The vulnerability is fixed in dnspython 2.9.0 and FastAPI 0.143.1. No workarounds are known.

A vulnerability in h11 versions up to 0.14.0 used by FastAPI allows malformed HTTP/1.1 chunked-encoding bodies to be accepted due to improper validation of trailing line terminators. This leniency can lead to HTTP request smuggling when combined with a buggy reverse proxy that parses chunked bodies differently. The issue is fixed in h11 version 0.15.0.