GHSA-qq3j-4f4f-9583
Hugging Face Transformers Regular Expression Denial of Service
At a glance
- Published
- Updated
- CVE
- CVE-2025-2099
- Aliases
- PYSEC-2025-40
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Description
A Regular Expression Denial of Service (ReDoS) exists in the `preprocess_string()` function of the `transformers.testing_utils` module. In versions **before 4.50.0**, the regex used to process code blocks in docstrings contains nested quantifiers that can trigger catastrophic backtracking when given inputs with many newline characters. An attacker who can supply such input to `preprocess_string()` (or code paths that call it) can force excessive CPU usage and degrade availability. **Fix:** released in **4.50.0**, which rewrites the regex to avoid the inefficient pattern. ([GitHub][1]) * **Affected:** `< 4.50.0` * **Patched:** `4.50.0`
Affected packages
| Package | Versions |
|---|---|
| PyPI · transformers | introduced 0, fixed 4.50.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-2099 ADVISORY
- https://github.com/huggingface/transformers/pull/36648 WEB
- https://github.com/huggingface/transformers/commit/8cb522b4190bd556ce51be04942720650b1a3e57 WEB
- https://github.com/huggingface/transformers PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2025-40.yaml WEB
- https://huntr.com/bounties/97b780f3-ffca-424f-ad5d-0e1c57a5bde4 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |