Hugging Face Transformers Regular Expression Denial of Service
A Regular Expression Denial of Service (ReDoS) exists in the `preprocess_string()` function of the `transformers.testing_utils` module. In versions **before 4.50.0**, the regex used to process code blocks in docstrings contains nested quantifiers that can trigger catastrophic backtracking when given inputs with many newline characters. An attacker who can supply such input to `preprocess_string()` (or code paths that call it) can force excessive CPU usage and degrade availability. **Fix:** released in **4.50.0**, which rewrites the regex to avoid the inefficient pattern. ([GitHub][1]) * **Affected:** `< 4.50.0` * **Patched:** `4.50.0`
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-2099US | high7.5 | — | ||
A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils` module in huggingface/transformers version v4.48.3 allows for a Regular Expression Denial… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/huggingface/transformersPACKAGE
- https://github.com/huggingface/transformers/commit/8cb522b4190bd556ce51be04942720650b1a3e57WEB
- https://github.com/huggingface/transformers/pull/36648WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2025-40.yamlWEB
- https://huntr.com/bounties/97b780f3-ffca-424f-ad5d-0e1c57a5bde4WEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-2099ADVISORY
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan