Summary
The /api/search/cve endpoint returns 500 Internal Server Error for an Apache HTTP Server CPE query when a sufficiently large result set includes a CVE containing NVD's metrics.ssvcV203 field.
The same query works through the FastCVE CLI because the CLI returns the raw stored JSON without FastAPI response-model validation.
Environment
- FastCVE image:
binare/fastcve:v1.4.0
- API endpoint:
/api/search/cve
- Failure also reproduces via
http://127.0.0.1:8000 inside the FastCVE container, so Traefik/reverse-proxy middleware is not involved.
Steps to reproduce
Use the following CPE:
cpe:2.3:a:apache:http_server:2.4.58:*:*:*:*:*:*:*
A smaller response succeeds:
curl --get 'http://127.0.0.1:8000/api/search/cve' \
--data-urlencode 'page-size=45' \
--data-urlencode 'cpe23=cpe:2.3:a:apache:http_server:2.4.58:*:*:*:*:*:*:*'
A larger response fails:
curl --get 'http://127.0.0.1:8000/api/search/cve' \
--data-urlencode 'page-size=2000' \
--data-urlencode 'cpe23=cpe:2.3:a:apache:http_server:2.4.58:*:*:*:*:*:*:*'
Actual result:
HTTP 500
Internal Server Error
The equivalent CLI query succeeds:
docker exec fastcve search \
--search-info cve \
--cpe23 'cpe:2.3:a:apache:http_server:2.4.58:*:*:*:*:*:*:*' \
--page-size 2000 \
--output json
Root cause
The failing result is:
Index: 47
CVE: CVE-2026-49975
That CVE contains the following legitimate NVD metric block:
"metrics": {
"cvssMetricV31": [
// omitted
],
"epss": {
"date": "2026-06-23",
"percentile": 0.95123,
"score": 0.10352
},
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-49975",
"options": [
{ "exploitation": "poc" },
{ "automatable": "yes" },
{ "technicalImpact": "partial" }
],
"role": "CISA Coordinator",
"timestamp": "2026-06-18T10:27:36.270403Z",
"version": "2.0.3"
}
}
]
}FastCVE's Metrics Pydantic model rejects unknown fields:
class Metrics(BaseModel):
class Config:
extra = Extra.forbidReference:
As a result, FastAPI response validation fails with:
Location: ('result', 47, 'metrics', 'ssvcV203')
Error: extra fields not permitted
Type: value_error.extra
CVE: CVE-2026-49975
Expected behavior
The API should return the CVE search result, including newly introduced NVD metric types, rather than failing the entire response because one CVE contains an unsupported metric family.
Suggested fix
Either:
- Allow additional metric fields in
Metrics:
class Metrics(BaseModel):
class Config:
extra = Extra.allowor
- Add a dedicated model for
ssvcV203.
Allowing additional fields would be more resilient to future NVD metric types and would prevent a newly introduced NVD field from breaking all API searches that include an affected CVE.
Summary
The
/api/search/cveendpoint returns500 Internal Server Errorfor an Apache HTTP Server CPE query when a sufficiently large result set includes a CVE containing NVD'smetrics.ssvcV203field.The same query works through the FastCVE CLI because the CLI returns the raw stored JSON without FastAPI response-model validation.
Environment
binare/fastcve:v1.4.0/api/search/cvehttp://127.0.0.1:8000inside the FastCVE container, so Traefik/reverse-proxy middleware is not involved.Steps to reproduce
Use the following CPE:
A smaller response succeeds:
A larger response fails:
Actual result:
The equivalent CLI query succeeds:
Root cause
The failing result is:
That CVE contains the following legitimate NVD metric block:
FastCVE's
MetricsPydantic model rejects unknown fields:Reference:
FastCVE/src/common/models/cve.py
Line 171 in 218e5f4
As a result, FastAPI response validation fails with:
Expected behavior
The API should return the CVE search result, including newly introduced NVD metric types, rather than failing the entire response because one CVE contains an unsupported metric family.
Suggested fix
Either:
Metrics:or
ssvcV203.Allowing additional fields would be more resilient to future NVD metric types and would prevent a newly introduced NVD field from breaking all API searches that include an affected CVE.