PYSEC-2025-40

🗓️ 19 May 2025 12:15:19Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 7 Views

Regular expression attack in transformers.testing_utils.preprocess_string caused by nested quantifiers in docstring code blocks.

Reporter	Title	Published	Views	Family All 25
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in transformers-4.48.3-py3-none-any.whl	22 Oct 202511:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	12 Nov 202507:25	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to regular expression denial of service (ReDoS) due to the transformers package (CVE-2025-2099)	27 Apr 202620:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in transformers-4.48.3-py3-none-any.whl	20 Sep 202511:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to transformers-4.48.0-py3-none-any.whl CVE-2025-2099	1 Sep 202510:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Denial of Service in huggingface/transformers [CVE-2025-2099]	28 Aug 202515:11	–	ibm
Huntr	Regular expression Denial of Service - ReDoS	11 Feb 202511:22	–	huntr
Circl	CVE-2025-2099	19 May 202511:44	–	circl
CNNVD	transformers 安全漏洞	19 May 202500:00	–	cnnvd
CVE	CVE-2025-2099	19 May 202511:22	–	cve

Vulners

Node

Source	Link
huntr	www.huntr.com/bounties/97b780f3-ffca-424f-ad5d-0e1c57a5bde4
github	www.github.com/huggingface/transformers/commit/8cb522b4190bd556ce51be04942720650b1a3e57
huntr	www.huntr.com/bounties/97b780f3-ffca-424f-ad5d-0e1c57a5bde4
github	www.github.com/advisories/GHSA-qq3j-4f4f-9583

21 May 2025 19:22Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.5

CVSS 35.3

EPSS0.00507

SSVC