Regular Expression Denial of Service (ReDoS)

Overview transformers is a State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the postprocesssingle function. An attacker can cause high CPU usage and potential application downtime b...

GHSA-6RVG-6V2M-4J46 Transformers Regular Expression Denial of Service (ReDoS) vulnerability

A Regular Expression Denial of Service ReDoS vulnerability was identified in the huggingface/transformers library, specifically in the file tokenizationnougatfast.py. The vulnerability occurs in the postprocesssingle function, where a regular expression processes specially crafted input. The issu...

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

A Regular Expression Denial of Service ReDoS vulnerability was identified in the huggingface/transformers library, specifically in the file tokenizationnougatfast.py. The vulnerability occurs in the postprocesssingle function, where a regular expression processes specially crafted input. The issu...

CVE-2024-12720

A Regular Expression Denial of Service ReDoS vulnerability was identified in the huggingface/transformers library, specifically in the file tokenizationnougatfast.py. The vulnerability occurs in the postprocesssingle function, where a regular expression processes specially crafted input. The issu...

CVE-2024-12720

CVE-2024-12720 affects Hugging Face Transformers, in particular the file tokenization_nougat_fast.py within the post_process_single() function. The issue is a RegEx that can exhibit exponential backtracking, leading to high CPU usage and potential DoS under crafted input. Affected version cited: ...

CVE-2024-12720 Regular Expression Denial of Service (ReDoS) in huggingface/transformers

A Regular Expression Denial of Service ReDoS vulnerability was identified in the huggingface/transformers library, specifically in the file tokenizationnougatfast.py. The vulnerability occurs in the postprocesssingle function, where a regular expression processes specially crafted input. The issu...

CVE-2024-12720 Regular Expression Denial of Service (ReDoS) in huggingface/transformers

A Regular Expression Denial of Service ReDoS vulnerability was identified in the huggingface/transformers library, specifically in the file tokenizationnougatfast.py. The vulnerability occurs in the postprocesssingle function, where a regular expression processes specially crafted input. The issu...

CVE-2024-12720 Regular Expression Denial of Service (ReDoS) in huggingface/transformers

A Regular Expression Denial of Service ReDoS vulnerability was identified in the huggingface/transformers library, specifically in the file tokenizationnougatfast.py. The vulnerability occurs in the postprocesssingle function, where a regular expression processes specially crafted input. The issu...

PT-2025-12141

Name of the Vulnerable Software and Affected Versions huggingface/transformers version v4.46.3 Description A Regular Expression Denial of Service ReDoS issue was identified in the huggingface/transformers library, specifically in the file tokenization nougat fast.py. The issue occurs in the post...

Hugging Face Transformers 安全漏洞

Hugging Face Transformers is Hugging Face's open source advanced natural language processing for Jax, PyTorch and TensorFlow. A security vulnerability exists in Hugging Face Transformers version v4.46.3, which stems from improper regular expression handling and could lead to a regular expression...

PT-2025-28155

Name of the Vulnerable Software and Affected Versions: Hugging Face Transformers versions prior to 4.52.1 Description: Hugging Face Transformers is affected by an improper input validation vulnerability in the image utils.py file. The vulnerability stems from insecure URL validation using the...

Regular expression Denial of Service - ReDoS

Description A regular expression denial of service ReDoS vulnerability has been identified in the Hugging Face Transformers library's dynamic module utilities. The vulnerability exists in the getimports function in dynamicmoduleutils.py, which uses a vulnerable regular expression pattern to filte...

PT-2025-28152

Name of the Vulnerable Software and Affected Versions: Hugging Face Transformers versions 4.49.0 through 4.50.0 Description: A Regular Expression Denial of Service ReDoS vulnerability exists in the Hugging Face Transformers library, specifically within the get imports function of dynamic module...

PT-2025-28151

Name of the Vulnerable Software and Affected Versions: Hugging Face Transformers version 4.49.0 Description: A Regular Expression Denial of Service ReDoS issue was discovered in the Hugging Face Transformers library, specifically in the get configuration file function within the...

Regular expression Denial of Service - ReDoS

Description The regex defined in the variable SETTINGRE contains repetition groups and non-optimized quantifiers, which can lead to exponential backtracking when receiving "almost matching" payloads. This may degrade the application's performance or even cause a denial-of-service DoS when...

PT-2025-28150

Name of the Vulnerable Software and Affected Versions: huggingface/transformers version 4.49.0 Description: A Regular Expression Denial of Service ReDoS vulnerability was discovered in the huggingface/transformers repository. The vulnerability is due to inefficient regular expression complexity i...

Exploit for Deserialization of Untrusted Data in Huggingface Transformers

CVE-2024-11394 Hugging Face Transformers Trax Model Deseri...

Exploit for Deserialization of Untrusted Data in Huggingface Transformers

CVE-2024-11393 Hugging Face Transformers MaskFormer Model D...

Exploit for Deserialization of Untrusted Data in Huggingface Transformers

CVE-2024-11392 Hugging Face Transformers MobileViTV2 Des...

Regular expression Denial of Service - ReDoS

Description A Regular Expression Denial of Service ReDoS vulnerability identified in the Transformers library, specifically in the file tokenizationnougatfast.py. The vulnerability occurs in the postprocesssingle function, where a regular expression processes specially crafted input. The issue...