PT-2025-12141 · Hugging Face · Huggingface/Transformers

Published 2025-03-20 · Updated 2025-08-01 · CVE-2024-12720

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions huggingface/transformers version v4.46.3

Description A Regular Expression Denial of Service (ReDoS) issue was identified in the huggingface/transformers library, specifically in the file tokenization nougat fast.py. The issue occurs in the post process single() function, where a regular expression processes specially crafted input, leading to excessive backtracking and significantly high CPU usage. This can result in potential application downtime, creating a Denial of Service (DoS) scenario.

Recommendations For version v4.46.3, consider disabling the post process single() function until a patch is available to prevent potential Denial of Service (DoS) scenarios. Restrict access to the tokenization nougat fast.py file to minimize the risk of exploitation. Avoid using the affected library until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2024-12720

GHSA-6RVG-6V2M-4J46

Affected Products

Huggingface/Transformers

References · 8

• 🔥 https://huntr.com/bounties/4bed1214-7835-4252-a853-22bbad891f98 · Exploit
• https://github.com/huggingface/transformers/commit/deac971c469bcbb182c2e52da0b82fb3bf54cccf · Patch
• https://osv.dev/vulnerability/GHSA-6rvg-6v2m-4j46 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12720 · Security Note
• https://osv.dev/vulnerability/CVE-2024-12720 · Vendor Advisory
• https://github.com/huggingface/transformers · Note
• https://twitter.com/CVEnew/status/1902671003357942101 · Twitter Post
• https://t.me/cveNotify/130618 · Telegram Post