Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-12720Regular Expression Denial of Service (ReDoS) in huggingface/transformers
Medium 5.3
In plain English
A medium-severity regular-expression denial of service in huggingface/transformers from huggingface. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py. The vulnerability occurs in the post_process_single() function, where a regular expression processes specially crafted input. The issue stems from the regex exhibiting exponential time complexity under certain conditions, leading to excessive backtracking. This can result in significantly high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.46.3 (latest).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | transformers | 4.48.0 | GHSA-6rvg-6v2m-4j46 |
| PyPI | transformers | 4.48.0 | PYSEC-2026-1982 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| huggingface | huggingface/transformers | unspecified – before 4.48.0 |
Weakness: CWE-1333 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L