| Package | Affected versions | Patched versions |
|---|---|---|
| transformers | < 4.49.0< 4.50.0 | 4.49.04.50.0 |
| transformers | ≤ 4.48.3 |
A Regular Expression Denial of Service (ReDoS) exists in the preprocess_string() function of the transformers.testing_utils module. In versions before 4.50.0, the regex used to process code blocks in docstrings contains nested quantifiers that can trigger catastrophic backtracking when given inputs with many newline characters. An attacker who can supply such input to preprocess_string() (or code paths that call it) can force excessive CPU usage and degrade availability.
Fix: released in 4.50.0, which rewrites the regex to avoid the inefficient pattern. ([GitHub][1])
< 4.50.04.50.0Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free