Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to transformers-4.48.0-py3-none-any.whl CVE-2025-2099

Summary IBM Maximo Application Suite - Monitor Component is vulnerable to transformers-4.48.0-py3-none-any.whl CVE-2025-2099. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2025-2099 DESCRIPTION: A vulnerability in the preprocessstring...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Denial of Service in huggingface/transformers [CVE-2025-2099]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Denial of Service in huggingface/transformers, due to an issue where the regular expression used to process code blocks in docstrings contains nested quantifiers, leading to exponential backtracking when processing input with a large...

Regular Expression Denial Of Service (ReDoS)

Hugging Face Transformers is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to the use of a regex pattern /^/^// in the converttfweightnametoptweightname function, which allows attackers to craft malicious input strings causing catastrophic backtracking and...

Enhancing GraphQL Security by Detecting Malicious Queries Using Large Language Models, Sentence Transformers, and Convolutional Neural Networks

GraphQL's flexibility, while beneficial for efficient data fetching, introduces unique security vulnerabilities that traditional API security mechanisms often fail to address. Malicious GraphQL queries can exploit the language's dynamic nature, leading to denial-of-service attacks, data...

fast-whisper-diarizer (>=0.1.2, <=0.1.32), faster-whisper-hotkey (>=0.5.0, <=0.5.5) +4 more potentially affected by CVE-2025-23303 via nemo-toolkit (>=2.0.0rc0, <=2.1.0)

nemo-toolkit PYPI version =2.0.0rc0, =0.1.2, =0.5.0, =1.0.0, =1.0.3, =1.0.7 Source cves: CVE-2025-23303 Source advisory: SNYK:PYTHON-NEMOTOOLKIT-12089392...

fast-whisper-diarizer (>=0.1.2, <=0.1.32), faster-whisper-hotkey (>=0.5.0, <=0.5.5) +4 more potentially affected by CVE-2025-23304 via nemo-toolkit (>=2.0.0rc0, <=2.1.0)

nemo-toolkit PYPI version =2.0.0rc0, =0.1.2, =0.5.0, =1.0.0, =1.0.3, =1.0.7 Source cves: CVE-2025-23304 Source advisory: SNYK:PYTHON-NEMOTOOLKIT-11953977...

SUSE CVE-2025-5197

A Regular Expression Denial of Service ReDoS vulnerability exists in the Hugging Face Transformers library, specifically in the converttfweightnametoptweightname function. This function, responsible for converting TensorFlow weight names to PyTorch format, uses a regex pattern /^/^// that can be...

CVE-2025-5197

A flaw was found in transformers. The converttfweightnametoptweightname function contains a Regular Expression Denial of Service ReDoS vulnerability, where a maliciously crafted input string can cause excessive backtracking during regular expression matching. This flaw allows a network-based...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2025-5197 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2025-5197 Source advisory: OSV:GHSA-9356-575X-2W9M...

pvqa (0.0.2.1) potentially affected by CVE-2025-5197 via transformers (2.1.1)

transformers PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - pvqa 0.0.2.1 Source cves: CVE-2025-5197 Source advisory: OSV:GHSA-9356-575X-2W9M...

nlp-architect (0.5.2), vtorch (0.1.69) potentially affected by CVE-2025-5197 via transformers (2.2.1)

transformers PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - nlp-architect 0.5.2 - vtorch 0.1.69 Source cves: CVE-2025-5197 Source advisory: OSV:GHSA-9356-575X-2W9M...

flambe (>=0.4.11, <=0.4.13) potentially affected by CVE-2025-5197 via transformers (2.2.2)

transformers PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - flambe =0.4.11, =0.4.13 Source cves: CVE-2025-5197 Source advisory: OSV:GHSA-9356-575X-2W9M...

custom-glue (>=0.0.1, <=0.0.6), megatron-bridge (>=0.3.0, <=0.3.1) +2 more potentially affected by CVE-2025-5197 via transformers (2.3.0)

transformers PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - custom-glue =0.0.1, =0.3.0, =0.0.5, =0.0.9 - nlp-architect 0.5.3 Source cves: CVE-2025-5197 Source advisory: OSV:GHSA-9356-575X-2W9M...

blanc (>=0.1.0, <=0.1.5) potentially affected by CVE-2025-5197 via transformers (2.4.0)

transformers PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - blanc =0.1.0, =0.1.5 Source cves: CVE-2025-5197 Source advisory: OSV:GHSA-9356-575X-2W9M...

allennlp (>=0.9.1.dev20200220, <=0.9.1.dev20200401), anilv-interpret-text (0.0.1) +9 more potentially affected by CVE-2025-5197 via transformers (2.4.1)

transformers PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200220, =0.5.8, =0.1.2, =0.0.12b0, =1.0.1, =1.0.0.dev202005031000, =0.1.1, =0.2.2, =0.3.0, =0.5.11 Source cves:...

aspect-based-sentiment-analysis (2.0.2), docly (>=0.0.4, <=0.2.1) +2 more potentially affected by CVE-2025-5197 via transformers (2.5.0)

transformers PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aspect-based-sentiment-analysis 2.0.2 - docly =0.0.4, =0.0.7b0, =0.1.9, =0.1.18 Source cves: CVE-2025-5197 Source advisory:...

boolean-question (0.0.3), ernie (0.0.19b0) +6 more potentially affected by CVE-2025-5197 via transformers (2.5.1)

transformers PYPI version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - boolean-question 0.0.3 - ernie 0.0.19b0 - methylbert =0.0.2, =0.0.1, =0.0.1a0, =0.1.1, =0.1.19, =0.2.0, =0.2.12 Source cves: CVE-2025-51...

smaberta (>=0.0.1, <=0.0.2), trl (0.0.2) potentially affected by CVE-2025-5197 via transformers (2.6.0)

transformers PYPI version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - smaberta =0.0.1, =0.0.2 - trl 0.0.2 Source cves: CVE-2025-5197 Source advisory: OSV:GHSA-9356-575X-2W9M...

allennlp (>=0.9.1.dev20200404, <=0.9.1.dev20200413), pygaggle (0.0.1) potentially affected by CVE-2025-5197 via transformers (2.7.0)

transformers PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200404, =0.9.1.dev20200413 - pygaggle 0.0.1 Source cves: CVE-2025-5197 Source advisory: OSV:GHSA-9356-575X-2W9M...

allennlp (>=0.9.1.dev20200415, <=1.0.0rc4.dev20200511), allennlp-models (>=1.0.0rc2, <=1.0.0rc3) +6 more potentially affected by CVE-2025-5197 via transformers (2.8.0)

transformers PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200415, =1.0.0rc2, =0.1.9, =0.0.2, =0.1.0, =0.3.2 Source cves: CVE-2025-5197 Source advisory: OSV:GHSA-9356-575X-2W...