The vulnerability of the SubWordJapaneseTokenizer function in the Hugging Face Transformers library, which allows a hacker to trigger a service failure.

🗓️ 06 Oct 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Vulnerability in SubWordJapaneseTokenizer causing remote service failures due to inefficient regex.

Reporter	Title	Published	Views	Family All 27
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Denial of Service in huggingface/transformers [CVE-2025-1194]	28 Aug 202515:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to transformers-4.46.3-py3-none-any.whl CVE-2025-1194	29 May 202507:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses vulnerable huggingface/transformers library.	23 Sep 202512:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in transformers-4.48.3-py3-none-any.whl	22 Oct 202510:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	12 Nov 202507:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in transformers-4.48.3-py3-none-any.whl	20 Sep 202511:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to denial of service [CVE-2024-6827, CVE-2025-1194]	9 May 202512:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Code Assistant On Prem product impacted by Input Handling Vulnerability in Transformers 4.49.0	23 Jul 202510:53	–	ibm
Huntr	Regular expression Denial of Service - ReDoS	22 Jan 202511:30	–	huntr
Chainguard	CVE-2025-1194 vulnerabilities	6 May 202519:14	–	cgr

Vulners

Node

hugging_face,transformersRange<4.50.0

Source	Link
github	www.github.com/huggingface/transformers/commit/92c5ca9dd70de3ade2af2eb835c96215cc50e815
huntr	www.huntr.com/bounties/86f58dcd-683f-4adc-a735-849f51e9abb2
web	www.web.nvd.nist.gov/view/vuln/detail

06 Oct 2025 00:00Current

6Medium risk

Vulners AI Score6

CVSS 34.3

CVSS 25

EPSS0.00384

SubWordJapaneseTokenizer Hugging Face Transformers inefficient regex remote service failure vulnerability