CVE-2024-12720: Transformers Regular Expression Denial of… – CVSS 7.5 · Watchpost

← 脆弱性一覧

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

高 7.5CVE-2024-12720 · GHSA-6rvg-6v2m-4j46 · PYSEC-2026-1982 · 20/03/2025 公開 · 17/06/2026 更新

要点

CVE-2024-12720 は transformers, transformers (huggingface) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.75%（全脆弱性の 54.9% より高い）。
対処：4.48.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
transformers PyPI	`< 4.48.0`	`4.48.0`
transformers huggingface	`< 4.48.0`	`4.48.0`

概要

A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py. The vulnerability occurs in the post_process_single() function, where a regular expression processes specially crafted input. The issue stems from the regex exhibiting exponential time complexity under certain conditions, leading to excessive backtracking. This can result in significantly high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.46.3.

NVD の説明

A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file tokenization_nougat_fast.py. The vulnerability occurs in the post_process_single() function, where a regular expression processes specially crafted input. The issue stems from the regex exhibiting exponential time complexity under certain conditions, leading to excessive backtracking. This can result in significantly high CPU usage and potential application downtime, effectively creating a Denial of Service (DoS) scenario. The affected version is v4.46.3 (latest).

参考情報

nvd.nist.gov/vuln/detail/CVE-2024-12720 · ADVISORY
huggingface/transformers commit deac971 · WEB
huggingface/transformers · PACKAGE
huntr.com/bounties/4bed1214-7835-4252-a853-22bbad891f98 · WEB
pypi.org/project/transformers · PACKAGE
GitHub Advisory GHSA-6rvg-6v2m-4j46 · ADVISORY

transformers のその他の脆弱性

すべて見る →

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン