TransformersGHSA-6rvg-6v2m-4j46
Transformers Regular Expression Denial of Service (ReDoS) vulnerability
Medium5.3CVE-2024-12720 · Published Mar 20, 2025 · updated Aug 13, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| transformers PyPI | < 4.48.0 | 4.48.0 |
Details and references
A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py. The vulnerability occurs in the post_process_single() function, where a regular expression processes specially crafted input. The issue stems from the regex exhibiting exponential time complexity under certain conditions, leading to excessive backtracking. This can result in significantly high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.46.3.
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-1333
- Also known as
- CVE-2024-12720, PYSEC-2026-1982
More Transformers advisories
All Transformers| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Apr 292025 | Transformers Regular Expression Denial of Service (ReDoS) vulnerability CVE-2025-1194Medium4.3fixed in 4.50.0 | Medium4.3 | 4.50.0 |
| May 192025 | Hugging Face Transformers Regular Expression Denial of Service CVE-2025-2099Medium5.3fixed in 4.50.0 | Medium5.3 | 4.50.0 |
| Jul 72025 | Transformers vulnerable to ReDoS attack through its SETTING_RE variable CVE-2025-3262Medium5.3fixed in 4.51.0 | Medium5.3 | 4.51.0 |
| Jul 72025 | Transformers vulnerable to ReDoS attack through its get_imports() function CVE-2025-3264Medium5.3fixed in 4.51.0 | Medium5.3 | 4.51.0 |
| Jul 72025 | Transformers's Improper Input Validation vulnerability can be exploited through username injection CVE-2025-3777Low3.5fixed in 4.52.1 | Low3.5 | 4.52.1 |
| Jul 72025 | Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking CVE-2025-3263Medium5.3fixed in 4.51.0 | Medium5.3 | 4.51.0 |